CVE-2022-35895: Insyde INSYDEH2O

High severity, CVSS 8.2. EPSS: 0.4% chance of exploitation in the next 30 days.

An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. The FwBlockSericceSmm driver does not properly validate input parameters for a software SMI routine, leading to memory corruption of arbitrary addresses including SMRAM, and possible arbitrary code execution.

Affected products

• Insyde INSYDEH2O: from 5.0, before 05.09.37 (fixed in 05.09.37); from 5.1, before 05.17.37 (fixed in 05.17.37); from 5.2, before 05.27.29 (fixed in 05.27.29); from 5.3, before 05.36.29 (fixed in 05.36.29); from 5.4, before 05.44.29 (fixed in 05.44.29); from 5.5, before 05.52.29 (fixed in 05.52.29)

Published 2022-09-21. Last modified 2026-06-17.