CVE-2022-35896: Insyde INSYDEH2O

Medium severity, CVSS 6.0. EPSS: 0.3% chance of exploitation in the next 30 days.

An issue SMM memory leak vulnerability in SMM driver (SMRAM was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. An attacker can dump SMRAM contents via the software SMI provided by the FvbServicesRuntimeDxe driver to read the contents of SMRAM, leading to information disclosure.

Affected products

• Insyde INSYDEH2O: from 5.0, up to and including 5.5

Published 2022-09-22. Last modified 2026-06-17.