CVE-2026-6484

Lack of verified boot to certain FV may cause arbitrary code execution

Assigner: Insyde
Reserved: 17.04.2026 Published: 12.08.2026 Updated: 12.08.2026

In an UEFI, Lack of verified boot to certain FV may cause arbitrary code execution.

Metrics

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS Score: 8.2

Attack Vector	Local	Scope	Changed
Attack Complexity	Low	Confidentiality Impact	High
Privileges Required	High	Integrity Impact	High
User Interaction	None	Availability Impact	High

CVSS 3.1

Product Status

Vendor	Insyde Software
Product	InsydeH2O
Versions	Default: unknown Version See in the Solution is unknown

Vendor

Insyde Software

Product

InsydeH2O

Versions

Default: unknown

Version See in the Solution is unknown

Solutions

Intel Mobile Platforms: Panther Lake: Unaffected Lunar Lake: Unaffected Aarow Lake H/U: Version 05.56.17.0022 Aarow Lake S/HX: Version 05.56.17.0037 Rapter Lake: Version 05.47.24.0058 Twin Lake: Version 05.44.45.0029

Intel Server/Embedded platforms: Whitley (CLX/CPX/ICX): Trunk CedarIsland (CPX): Trunk Eagle Stream: Unaffected Birch Stream: Unaffected Mehlow/Mehlow-R(CFL-S): Unaffected Tatlow (RKS): Unaffected Jacobsville(SNR): Trunk Idaville: Trunk Kaseyville: Unaffected Whiskey Lake: Trunk Come tLake-S: Unaffected Tiger Lake UP3/H: Unaffected Alder Lake: Version 05.47.24.2057 Raptor Lake: Version 05.47.24.0057 Meteor Lake – U/H ARL-H/U: Version 05.56.07.0022 Meteor Lake – PS ARL-H/U: Version 05.56.07.0022 Arrow Lake – S ARL-S/HX: Version 05.55.45.0036 Arrow Lake – U/H ARL-H/U: Version 05.56.07.0022 Elkhart Lake: Version 05.48.17.0030 Alder Lake N: Trunk Amston Lake: Trunk Twin Lake: Trunk

Credits

Thanks to Nikolaj Schlej, independent firmware security researcher, for reporting the vulnerability and engaging in this coordinated disclosure. reporter

References

Problem Types

CWE-1277: Insufficient Verification of Data Authenticity in Firmware CWE