CVE-2026-12855 PUBLISHED

H19WMIHandlerSmm: unvalidated memory boundary could result in arbitrary code execution.

Assigner: Insyde
Reserved: 22.06.2026 Published: 09.09.2026 Updated: 09.09.2026

Unvalidated memory boundary could result in arbitrary code execution. The vulnerability exists in the code developed specifically for HP projects.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS Score: 8.2

Attack Vector	Local	Scope	Changed
Attack Complexity	Low	Confidentiality Impact	High
Privileges Required	High	Integrity Impact	High
User Interaction	None	Availability Impact	High

CVSS 3.1

Product Status

Vendor	Insyde Software
Product	InsydeH2O
Versions	Default: unaffected Version See in the Solution is affected

Solutions

HP feature version – Platform 5.4: 05.47.2701.2631 – Platform 5.5: 05.55.45.2630 – Platform 5.6: 05.62.29.2630 – Platform 5.7: 05.72.21.2630 – Platform 6.0: 06.01.23.2630

References

https://www.insyde.com/security-pledge/sa-2026009/

Problem Types

CWE-20: Improper Input Validation CWE