# CVE-2021-43614: Insyde InsydeH2O buffer overflow in PlatformLangCodes UEFI variable handling

Source: https://junglewise.ai/threats/cve-2021-43614-insyde-insydeh2o-buffer-overflow-in-platformlangcodes-uefi  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-03. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2021-43614 · Severity: medium · CVSS 6.7 · Published 2026-09-03

InsydeH2O is firmware used in many systems to manage boot and configuration settings. A buffer overflow vulnerability in how the firmware handles the PlatformLangCodes UEFI variable could allow an attacker with high privileges to crash the system or cause resource exhaustion, resulting in service unavailability. An attacker would need physical or administrative access to the system to exploit this issue.

Technologies: [InsydeH2O](https://junglewise.ai/threats/technologies/insydeh2o). Vendors: [Insyde](https://junglewise.ai/threats/vendors/insyde).

## Quick answers

**Is CVE-2021-43614 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2021-43614 being exploited in the wild.

**How severe is CVE-2021-43614?** Medium severity, with a CVSS score of 6.7, published 3 September 2026.

**Which products and versions are affected?** InsydeH2O before 01.01.04.0008.

**Is there a fix for CVE-2021-43614?** A patch was published on 2022-02-21: Fixed in InsydeH2O feature version 01.01.04.0008 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2021-43614 attacked?** It is attacked with physical access.

**Am I affected by CVE-2021-43614?** Check whether you run InsydeH2O at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The VariableEditSmm driver in InsydeH2O improperly handles the PlatformLangCodes UEFI variable, leading to a buffer overflow condition. The vulnerability is triggered via improper input validation when processing this variable, and requires high privilege level (PR:H) and user interaction (UI:R) to exploit. The attack vector is physical (AV:P) with high attack complexity (AC:H). Successful exploitation can cause resource exhaustion, system failure, and potential code execution. The vulnerability was fixed in InsydeH2O feature version 01.01.04.0008 and later.

## Affected products

- Insyde InsydeH2O before 01.01.04.0008

## Timeline

- 2022-02-21: disclosed: Initial public disclosure by Insyde
- 2022-02-21: patched: Fixed in InsydeH2O feature version 01.01.04.0008

## References

- [https://www.insyde.com/security-pledge/sa-2022026/](https://www.insyde.com/security-pledge/sa-2022026/)

## Related threats

- [Insyde InsydeH2O Secure Boot bypass via embedded shell](https://junglewise.ai/threats/cve-2026-6485-insyde-insydeh2o-secure-boot-bypass-via-embedded-shell)
- [Insyde InsydeH2O memory boundary validation vulnerability](https://junglewise.ai/threats/cve-2026-12855-insyde-insydeh2o-memory-boundary-validation-vulnerability)
- [Insyde InsydeH2O password hash exposure in SysPasswordDxe](https://junglewise.ai/threats/cve-2021-43613-insyde-insydeh2o-password-hash-exposure-in-syspassworddxe)
- [Insyde InsydeH2O plaintext HDD password storage in UEFI variable](https://junglewise.ai/threats/cve-2021-38489-insyde-insydeh2o-plaintext-hdd-password-storage-in-uefi-variable)
- [Insyde InsydeH2O buffer overflow in SMM IHISI FMTSWriteUseIntelLib](https://junglewise.ai/threats/cve-2026-9805-insyde-insydeh2o-buffer-overflow-in-smm-ihisi-fmtswriteuseintellib)