{"cve":"CVE-2022-32471","nvd":{"published":"2023-02-15T02:15:09.623","modified":"2026-06-17T04:47:19.173","status":"Modified","description":"An issue was discovered in IhisiSmm in Insyde InsydeH2O with kernel 5.0 through 5.5. The IhisiDxe driver uses the command buffer to pass input and output data. By modifying the command buffer contents with DMA after the input parameters have been checked but before they are used, the IHISI SMM code may be convinced to modify SMRAM or OS, leading to possible data corruption or escalation of privileges.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.0},"cwes":["CWE-367"],"references":["https://www.insyde.com/security-pledge","https://www.insyde.com/security-pledge/SA-2023003","https://www.insyde.com/security-pledge","https://www.insyde.com/security-pledge/SA-2023003"],"products":["insyde:insydeh2o"],"source":"nvd","synced_at":"2026-10-19T21:37:38.595364862+00:00"},"epss":{"cve":"CVE-2022-32471","score":0.00132,"percentile":0.02769,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}