CVE-2025-4276 HIGH

CVE-2025-4276: UsbCoreDxe: improper input validation may lead to arbitrary code execution

Vendor Insyde Software
Product InsydeH2O
Weakness CWE-20 · Input validation
Published August 13, 2025
Last update August 14, 2025
View on NVD All CVEs

CVSS base score

7.5/10
Attack vector Local
Attack complexity High
Privileges required High
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

UsbCoreDxe has a vulnerability which can be used to write arbitrary memory inside SMRAM and execute arbitrary code at SMM level.

Key dates

02Disclosure timeline

August 13, 2025 CVE published
August 14, 2025 Record updated