CVE-2021-33834

HIGH 7.1CVE-2021-33834 · Published 08/09/2023 · updated 17/06/2026

In short

CVE-2021-33834 is a HIGH (CVSS 7.1) vulnerability affecting h2offt (insyde), iscflashx64.sys (insyde).
Chance of exploitation in the next 30 days (EPSS): 0.19%, higher than 8.5% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
h2offt insyde	`= 6.20.00`	No fix yet
iscflashx64.sys insyde	`= 3.9.3.0`	No fix yet

Description

An issue was discovered in iscflashx64.sys 3.9.3.0 in Insyde H2OFFT 6.20.00. When handling IOCTL 0x22229a, the input used to allocate a buffer and copy memory is mishandled. This could cause memory corruption or a system crash.

References

insyde.com/security-pledge · Not Applicable
insyde.com/security-pledge/SA-2021004 · Vendor Advisory

More vulnerabilities in h2offt

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free