Insyde Security Advisory 2022039

Insyde ID Advisory Category Impact of Vulnerability Severity Rating Original Date Last Revised
INSYDE-SA-2022039 Software CVSS3.1:AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H 7.7 11/04/2022 11/04/2022


Stack buffer overflow vulnerability leads to arbitrary code execution.

Vulnerability Details


This issue affects the MebxConfiguration driver of InsydeH2O in releases supporting specific chipsets. The issue was discovered by the Binarly efiXplorer team. This issue is fixed in various InsydeH2O versions, depending on the chipset:

This was fixed in the Kernel, versions:

Ice Lake: Version
Tiger Lake: Version
Alder Lake: Version
Snow Ridge: Version
Denverton: Version
NEX Alder Lake: IB16560316 @ Trunk

All other Intel and all AMD platforms are unaffected.


This issue was described by the Binarly efiXplorer team (

Revision History:

Revision Date Description
1.0 11/04/2022 Initial Release
- - -

Return to Insyde's Security Pledge