CVE-2026-12855
Awaiting Analysis Awaiting Analysis - Queue

Memory Corruption in HP Project Code

Publication date: 2026-09-09

Last updated on: 2026-09-09

Assigner: Insyde

Description
Unvalidated memory boundary could result in arbitrary code execution. The vulnerability exists in the code developed specifically for HP projects.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-09
Last Modified
2026-09-09
Generated
2026-09-29
AI Q&A
2026-09-09
EPSS Evaluated
2026-09-27
NVD
CVE-2026-12855
EUVD
EUVD-2026-74615

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
insyde_software insydeh2o From 8.2 (inc)
hp platform 5.4
hp platform 5.5
hp platform 5.6
hp platform 5.7
hp platform 6.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an unvalidated memory boundary issue in code developed for HP projects, specifically in the H19WMIHandlerSmm component of InsydeH2O 8.2. It allows arbitrary code execution due to improper input validation, classified under CWE-20.

Detection Guidance

Check if your system uses InsydeH2O firmware versions 8.2 or earlier. Verify the H19WMIHandlerSmm component for unvalidated memory boundaries. Use firmware inspection tools or HP's detection utilities to scan for affected versions.

Impact Analysis

An attacker could exploit this flaw to execute arbitrary code on affected systems, potentially leading to unauthorized access, data theft, or system compromise. The high CVSS score indicates significant risk.

Compliance Impact

This vulnerability could lead to arbitrary code execution due to improper input validation, potentially allowing unauthorized access to sensitive data. Such breaches may violate compliance requirements under GDPR (data protection) and HIPAA (health information security) by exposing personal or health data. The high CVSS score (8.2) indicates significant risk to confidentiality and integrity.

Mitigation Strategies

Update InsydeH2O firmware to the latest patched versions (05.47.2701.2631 or later). Apply HP platform-specific fixes for versions 5.4, 5.5, 5.6, 5.7, or 6.0. Disable unnecessary services or components linked to H19WMIHandlerSmm if updates are not immediately available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-12855. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart