CVE-2026-9805: CWE-787 Out-of-bounds write in Insyde Software InsydeH2O

This vulnerability (CWE-787) affects the SMM IHISI command handler function FMTSWriteUseIntelLib in InsydeH2O firmware. The handler processes the FMTS command 0x32 by reading and writing data without validating the buffer size, which can lead to an out-of-bounds write condition. The CVSS 3.1 base score is 2.7, indicating low severity, with attack vector requiring physical presence (AV:P), high attack complexity (AC:H), high privileges (PR:H), and user interaction (UI:R). The impact includes low integrity and low availability impact but no confidentiality impact. No patch or remediation information is currently available, and no known exploits are reported in the wild.

The vulnerability could allow an attacker with high privileges and physical access to cause a buffer overflow via the FMTS command 0x32 in the SMM IHISI command handler. This may result in limited integrity and availability impact on the affected system. Confidentiality is not impacted. Due to the required conditions (physical access, high privileges, user interaction), the overall risk is low.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or mitigation is currently documented. Until a patch is available, limit physical access to affected systems and restrict high-privilege operations involving the FMTS command 0x32 if possible.