CVE-2023-39281

9.8 criticalEPSS 0.5%

Critical (9.8) in insyde insydeh2o. EPSS 0.5% chance of exploitation in the next 30 days.

A stack buffer overflow vulnerability discovered in AsfSecureBootDxe in Insyde InsydeH2O with kernel 5.0 through 5.5 allows attackers to run arbitrary code execution during the DXE phase.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 41% of CVEs (scores of 2026-10-31)
CWEs: CWE-787, CWE-121
Published: 2023-11-01
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

insyde:insydeh2o

References

https://www.insyde.com/security-pledge
https://www.insyde.com/security-pledge/SA-2023054
https://www.insyde.com/security-pledge
https://www.insyde.com/security-pledge/SA-2023054

Check your stack JSON