Attributed metadata history
Up to 100 retained publisher events per page for c649a5fd1c3c77b3cb2f3dc63bf4f3bb4c83225bdaa8ae222a20e1e1f197c6bd. Withdrawals and unavailable references remain attributed to their publishers.
intelligence_src_cd638cf167c7c119d6
observed · 2026-10-12 15:23:03 UTC
available
Fingerprint: e9e546feaa1a197f9c3a53bee19e29f6899cd295cb68e67b1de5b309ac3481e8
intelligence_src_cd638cf167c7c119d6
observed · 2026-10-12 15:23:03 UTC
Overview An Out-of-bounds Write vulnerability in the InsydeH2O IHISI software used by HP PC BIOS can allow a local attacker with OS kernel privileges to perform arbitrary physical memory writes, including writes to System Management RAM (SMRAM). Because the vulnerable code executes in System Management Mode (SMM), successful exploitation can allow an attacker to modify SMM-protected memory and potentially achieve arbitrary code execution in SMM. Depending on the platform's memory and firmware configuration, the arbitrary physical memory write primitive may also have implications for UEFI firmware update or flash-related operations. Description HP PC BIOS is firmware that initializes and manages hardware components during the boot process and provides runtime services to the operating system and provide the ability to update firmware. The affected system uses InsydeH2O Kernel version 5.5 or earlier. The BIOS includes custom HP SMM handlers that execute in System Management Mode (SMM), a highly privileged CPU execution mode that is isolated from the operating system. CVE-2026-12855: An Out-of-bounds Write vulnerability in the H19WMIHandlerSmm module (GUID f1946499-571b-44c3-9b9c-cc5
Fingerprint: 23b35e570da4b72a42767c3f5327afc412b72fea7ba6cf685845acc5be4715e5