CVE-2026-9805: Insyde InsydeH2O buffer overflow in SMM IHISI FMTSWriteUseIntelLib

CVE-2026-9805 · Severity: low · CVSS 2.7 · Published 2026-08-26

InsydeH2O is firmware used in Intel-based systems. A buffer overflow vulnerability in the SMM (System Management Mode) IHISI command handler allows code to overwrite memory without proper size validation, potentially compromising firmware integrity and enabling privilege escalation or system compromise.

Technologies: InsydeH2O. Vendors: Insyde.

Quick answers

Is CVE-2026-9805 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-9805 being exploited in the wild.
How severe is CVE-2026-9805?
Low severity, with a CVSS score of 2.7, published 26 August 2026.
Which products and versions are affected?
InsydeH2O Multiple versions across Intel platforms; patches issued for WildCat Lake 05.72.18.0010, Panther Lake 05.72.17.0032, Lunar Lake 05.62.29.0038, Arrow Lake-H/U 05.56.23.0022, Arrow Lake-S/HX 05.56.23.0037, Raptor Lake 05.47.24.0058, Twin Lake 05.44.45.0029.
Is there a fix for CVE-2026-9805?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-9805 attacked?
It is attacked with physical access.
Am I affected by CVE-2026-9805?
Check whether you run InsydeH2O at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is a buffer overflow vulnerability (CWE-787) in the FMTSWriteUseIntelLib SMM IHISI command handler processing FMTS command 0x32. The vulnerable code reads and writes data without validating buffer boundaries, enabling an out-of-bounds write. The attack requires physical access (adjacent/local attack vector) and high privilege context. An attacker with physical or platform management access could overwrite SMM memory, potentially achieving arbitrary code execution in the most privileged processor mode. Patches are available for multiple Intel platform families (WildCat Lake, Panther Lake, Lunar Lake, Arrow Lake, Raptor Lake, and others) as detailed in the Insyde security advisory.

Affected products

  • Insyde InsydeH2O Multiple versions across Intel platforms; patches issued for WildCat Lake 05.72.18.0010, Panther Lake 05.72.17.0032, Lunar Lake 05.62.29.0038, Arrow Lake-H/U 05.56.23.0022, Arrow Lake-S/HX 05.56.23.0037, Raptor Lake 05.47.24.0058, Twin Lake 05.44.45.0029

Timeline

  • 2026-08-25: disclosed
  • 2026-08-26: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.