CVE-2023-39281

CRITICAL 9.8CVE-2023-39281 · Published 01/11/2023 · updated 17/06/2026

In short

CVE-2023-39281 is a CRITICAL (CVSS 9.8) vulnerability affecting insydeh2o (insyde).
Chance of exploitation in the next 30 days (EPSS): 0.49%, higher than 42.4% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
insydeh2o insyde	`= 05.42.37.0031= 05.43.06.0021= 05.44.30.0022= 05.44.34.0055= 05.44.45.0017= 05.45.24.0039= 05.45.38.0005= 05.53.22.0008= 05.53.23.0011= 05.53.23.0014= 05.53.28.0013`	No fix yet

Description

A stack buffer overflow vulnerability discovered in AsfSecureBootDxe in Insyde InsydeH2O with kernel 5.0 through 5.5 allows attackers to run arbitrary code execution during the DXE phase.

References

insyde.com/security-pledge · Vendor Advisory
insyde.com/security-pledge/SA-2023054 · Vendor Advisory

More vulnerabilities in insydeh2o

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

insydeh2o

insyde

= 05.42.37.0031= 05.43.06.0021= 05.44.30.0022= 05.44.34.0055= 05.44.45.0017= 05.45.24.0039= 05.45.38.0005= 05.53.22.0008= 05.53.23.0011= 05.53.23.0014= 05.53.28.0013

No fix yet

More vulnerabilities in insydeh2o

See all →