CVE-2026-12855: CWE-20: Improper Input Validation in Insyde Software InsydeH2O

CVE-2026-12855 is an out-of-bounds write vulnerability in the H19WMIHandlerSmm module of InsydeH2O IHISI software used in HP PC BIOS. The vulnerability allows a local attacker with OS kernel privileges to issue a Software SMI through I/O port 0xB2 with crafted CPU register values, causing the SMM handler to perform arbitrary physical memory writes, including to SMRAM. Because SMM is a highly privileged and isolated CPU mode, this can lead to modification of SMM code or data, potentially enabling arbitrary code execution and persistence within SMM. The vulnerability affects InsydeH2O Kernel version 5.5 or earlier. The ability to modify firmware or ROM contents depends on platform-specific memory and firmware configurations and is not guaranteed. The vulnerability was publicly disclosed on 2026-10-01 with a CVSS v3.1 score of 8.2 (high severity).

An attacker with privileged OS kernel access can exploit this vulnerability to write arbitrary physical memory, including SMRAM, by triggering a Software SMI with crafted parameters. This can allow the attacker to modify or replace SMM code or data, potentially achieving arbitrary code execution in SMM, which is highly privileged and isolated from the operating system. This can lead to persistent compromise of the system at a firmware level. The impact includes full confidentiality, integrity, and availability compromise of the affected system's firmware execution environment. The ability to affect firmware or ROM contents is platform-dependent and not guaranteed.

Users should check HP's security bulletins and Insyde's advisory at https://www.insyde.com/security-pledge/sa-2026009/ to determine if their system is affected and to obtain remediation guidance. The advisory does not explicitly state if a patch is currently available; therefore, patch status is not yet confirmed — users must consult the vendor advisories for current remediation status. Until a fix is applied, restricting kernel-level access and limiting local administrative privileges can reduce risk. No vendor advisory states that no action is required or that the issue is already mitigated.