CVE-2021-45969: insyde insydeh2o Out-of-bounds Write
Vulnerability summary
CVE-2021-45969 is a high (CVSS 8.2) Out-of-bounds Write vulnerability in insyde insydeh2o. EPSS estimates a 0.28% chance of exploitation in the next 30 days, higher than 19.1% of scored vulnerabilities.
Timeline
- 05-01-2022PublishedVulnerability first disclosed.
- 11-08-2026Last modifiedVulnerability information updated.
Description
An issue was discovered in AhciBusDxe in Insyde InsydeH2O with kernel 5.1 before 05.16.25, 5.2 before 05.26.25, 5.3 before 05.35.25, 5.4 before 05.43.25, and 5.5 before 05.51.25. A vulnerability exists in the SMM (System Management Mode) branch that registers a SWSMI handler that does not sufficiently check or validate the allocated buffer pointer (the CommBuffer+8 location).
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
0.28%
Chance of exploitation in the next 30 days
Percentile
19%
Versus all other CVEs
30-day change
0.00 pp
From 0.28% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Insyde1 product
- insydeh2o≥ 5.1, < 5.16.25 | ≥ 5.2, < 5.26.25 | ≥ 5.3, < 5.35.25 | ≥ 5.4, < 5.43.25 | ≥ 5.5, < 05.51.25
1 vendor · 1 product