# CVE-2026-12855: Insyde InsydeH2O memory boundary validation vulnerability

Source: https://junglewise.ai/threats/cve-2026-12855-insyde-insydeh2o-memory-boundary-validation-vulnerability  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-09. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-12855 · Severity: high · CVSS 8.2 · Published 2026-09-09

InsydeH2O is firmware used in HP systems. An unvalidated memory boundary condition in the H19WMIHandlerSmm component could allow a privileged local attacker to execute arbitrary code with high privileges, potentially compromising the entire system including all confidentiality, integrity, and availability of data.

Technologies: [InsydeH2O](https://junglewise.ai/threats/technologies/insydeh2o). Vendors: [Insyde](https://junglewise.ai/threats/vendors/insyde).

## Quick answers

**Is CVE-2026-12855 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-12855 being exploited in the wild.

**How severe is CVE-2026-12855?** High severity, with a CVSS score of 8.2, published 9 September 2026.

**Which products and versions are affected?** InsydeH2O Platform 5.4, 5.5, 5.6, 5.7, 6.0 (prior to patched versions: 05.47.2701.2631, 05.55.45.2630, 05.62.29.2630, 05.72.21.2630, 06.01.23.2630).

**Is there a fix for CVE-2026-12855?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-12855 attacked?** It is attacked with local access, in device firmware.

**Am I affected by CVE-2026-12855?** Check whether you run InsydeH2O at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability is an improper input validation issue (CWE-20) in the H19WMIHandlerSmm component of InsydeH2O firmware. The unvalidated memory boundary condition could result in arbitrary code execution. The attack vector is local with high privilege requirements (PR:H) and no user interaction needed. An attacker with high privileges can exploit this to achieve complete system compromise with high impact to confidentiality, integrity, and availability. Patches are available via HP feature version updates across platforms 5.4 through 6.0.

## Affected products

- Insyde InsydeH2O Platform 5.4, 5.5, 5.6, 5.7, 6.0 (prior to patched versions: 05.47.2701.2631, 05.55.45.2630, 05.62.29.2630, 05.72.21.2630, 06.01.23.2630)

## Timeline

- 2026-09-08: disclosed
- 2026-09-09: advisory

## References

- [https://www.insyde.com/security-pledge/sa-2026009/](https://www.insyde.com/security-pledge/sa-2026009/)

## Related threats

- [Insyde InsydeH2O Secure Boot bypass via embedded shell](https://junglewise.ai/threats/cve-2026-6485-insyde-insydeh2o-secure-boot-bypass-via-embedded-shell)
- [Insyde InsydeH2O buffer overflow in PlatformLangCodes UEFI variable handling](https://junglewise.ai/threats/cve-2021-43614-insyde-insydeh2o-buffer-overflow-in-platformlangcodes-uefi)
- [Insyde InsydeH2O password hash exposure in SysPasswordDxe](https://junglewise.ai/threats/cve-2021-43613-insyde-insydeh2o-password-hash-exposure-in-syspassworddxe)
- [Insyde InsydeH2O plaintext HDD password storage in UEFI variable](https://junglewise.ai/threats/cve-2021-38489-insyde-insydeh2o-plaintext-hdd-password-storage-in-uefi-variable)
- [Insyde InsydeH2O buffer overflow in SMM IHISI FMTSWriteUseIntelLib](https://junglewise.ai/threats/cve-2026-9805-insyde-insydeh2o-buffer-overflow-in-smm-ihisi-fmtswriteuseintellib)