InsydeH2O UEFI Firmware Creation Framework Code Execution

The vulnerability of the AcpiS3SaveDxe and ChipsetSvcDxe drivers in the InsydeH2O UEFI firmware framework is related to writing beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

CVE-2024-49200: Out-of-bounds Write

An issue was discovered in AcpiS3SaveDxe and ChipsetSvcDxe in Insyde InsydeH2O with kernel 5.2 though 5.7. A potential DXE memory corruption vulnerability has been identified. The root cause is use of a pointer originating from the value of an NVRAM variable as the target of a write operation. Th...

PT-2025-48860

Уязвимость драйверов AcpiS3SaveDxe и ChipsetSvcDxe фреймворка для создания UEFI-прошивок InsydeH2O связана с записью за границами буфера в памяти. Эксплуатация уязвимости может позволить нарушителю выполнить произвольный код...

PT-2025-16503

Name of the Vulnerable Software and Affected Versions Insyde InsydeH2O versions 5.2 through 5.7 Description A potential memory corruption issue has been identified in AcpiS3SaveDxe and ChipsetSvcDxe. The root cause is the use of a pointer originating from the value of an NVRAM variable as the...