← CVE Intelligence

CVE-2025-4276

UsbCoreDxe: improper input validation may lead to arbitrary code execution PUBLISHED

Description (CNA)

UsbCoreDxe has a vulnerability which can be used to write arbitrary memory inside SMRAM and execute arbitrary code at SMM level.

Affected (CNA)

Vendor / productVersions
Insyde Software / InsydeH2Oaffected Kernel 5.3 before 05.39.18; affected Kernel 5.4 before 05.47.18; affected Kernel 5.5 before 05.55.18; affected Kernel 5.6 before 05.62.18; affected Kernel 5.7 before 05.71.18

CWE

CWE-20

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.