Is CVE-2021-43614 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2021-43614 being exploited in the wild.

How severe is CVE-2021-43614?

Medium severity, with a CVSS score of 6.7, published 3 September 2026.

Which products and versions are affected?

InsydeH2O before 01.01.04.0008.

Is there a fix for CVE-2021-43614?

A patch was published on 2022-02-21: Fixed in InsydeH2O feature version 01.01.04.0008 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2021-43614 attacked?

It is attacked with physical access.

Am I affected by CVE-2021-43614?

Check whether you run InsydeH2O at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2021-43614: Insyde InsydeH2O buffer overflow in PlatformLangCodes UEFI variable handling

CVE-2021-43614 · Severity: medium · CVSS 6.7 · Published 2026-09-03

InsydeH2O is firmware used in many systems to manage boot and configuration settings. A buffer overflow vulnerability in how the firmware handles the PlatformLangCodes UEFI variable could allow an attacker with high privileges to crash the system or cause resource exhaustion, resulting in service unavailability. An attacker would need physical or administrative access to the system to exploit this issue.

Technologies: InsydeH2O. Vendors: Insyde.

Quick answers

Is CVE-2021-43614 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2021-43614 being exploited in the wild.
How severe is CVE-2021-43614?: Medium severity, with a CVSS score of 6.7, published 3 September 2026.
Which products and versions are affected?: InsydeH2O before 01.01.04.0008.
Is there a fix for CVE-2021-43614?: A patch was published on 2022-02-21: Fixed in InsydeH2O feature version 01.01.04.0008 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2021-43614 attacked?: It is attacked with physical access.
Am I affected by CVE-2021-43614?: Check whether you run InsydeH2O at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The VariableEditSmm driver in InsydeH2O improperly handles the PlatformLangCodes UEFI variable, leading to a buffer overflow condition. The vulnerability is triggered via improper input validation when processing this variable, and requires high privilege level (PR:H) and user interaction (UI:R) to exploit. The attack vector is physical (AV:P) with high attack complexity (AC:H). Successful exploitation can cause resource exhaustion, system failure, and potential code execution. The vulnerability was fixed in InsydeH2O feature version 01.01.04.0008 and later.

Affected products

Insyde InsydeH2O before 01.01.04.0008

Timeline

2022-02-21: disclosed: Initial public disclosure by Insyde
2022-02-21: patched: Fixed in InsydeH2O feature version 01.01.04.0008

References

https://www.insyde.com/security-pledge/sa-2022026/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.