VU#553437: InsydeH2O IHISI SMM is vulnerable to unsafe memory write operations

2026-10-01T20:52:02Z•d92626f79c993e7c5c1740b2a03f999716fc48c1648bd468086ce9524f0948c8
CVE-2026-12855CVE-2026-18311CVE-2026-18312CVE-2026-75907CVE-2026-82356CVE-2026-82987CVE-2026-82988CVE-2026-82989CVE-2026-86867CVE-2026-96760AndroidAuthlibBIOSCERT/CCIoTJWSKotaemonRFIDSMMXSSarbitrary-memory-writeauthentication-bypassauthorization-bypassdata-exfiltrationenterprise-authenticationfirmwarekey-managementphysical-accessremote-code-executionsmartboard

What happened

The CERT/CC feed describes multiple newly disclosed vulnerabilities affecting firmware, authentication libraries, mobile applications, smartboard systems, physical access control, enterprise identity infrastructure, and multi-user AI applications. Impacts include arbitrary SMM memory writes and possible firmware compromise, JWS signature-verification bypass, stored XSS, unauthenticated screen capture and device compromise, clonable RFID credentials, persistent appliance impersonation due to non-rotatable keys, and cross-user conversation access and modification. Several issues enable severe or

Why it matters

A reviewed impact interpretation has not been published for this record.

Evidence and limitations

Source ID
certcc_vulnotes
Record identifier
d92626f79c993e7c5c1740b2a03f999716fc48c1648bd468086ce9524f0948c8
Enrichment time
2026-10-01T20:52:02Z
AI-assisted enrichment
Yes

This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.