CVE-2021-41842: Insyde INSYDEH2O

Critical severity, CVSS 9.8. EPSS: 1.5% chance of exploitation in the next 30 days.

An issue was discovered in AtaLegacySmm in the kernel 5.0 before 05.08.46, 5.1 before 05.16.46, 5.2 before 05.26.46, 5.3 before 05.35.46, 5.4 before 05.43.46, and 5.5 before 05.51.45 in Insyde InsydeH2O. Code execution can occur because the SMI handler lacks a CommBuffer check.

Affected products

• Insyde INSYDEH2O: from 5.0, before 05.08.46 (fixed in 05.08.46); from 5.1, before 05.16.46 (fixed in 05.16.46); from 5.2, before 05.26.46 (fixed in 05.26.46); from 5.3, before 05.35.46 (fixed in 05.35.46); after 5.4, before 05.43.46 (fixed in 05.43.46); from 5.5, before 05.51.45 (fixed in 05.51.45)

Published 2022-01-06. Last modified 2026-06-17.