CVE-2026-6484 - Vulnerability Details - OpenCVE

In an UEFI, Lack of verified boot to certain FV may cause arbitrary code execution.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Insyde	Insydeh2o

No data.

No data.

References

Link	Providers
https://www.insyde.com/security-pledge/sa-2026003/

History

Thu, 13 Aug 2026 10:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Insyde Insyde insydeh2o
Vendors & Products		Insyde Insyde insydeh2o

Wed, 12 Aug 2026 13:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Wed, 12 Aug 2026 00:45:00 +0000

Type	Values Removed	Values Added
Description		In an UEFI, Lack of verified boot to certain FV may cause arbitrary code execution.
Title		Lack of verified boot to certain FV may cause arbitrary code execution
Weaknesses		CWE-1277
References		https://www.insyde.com/security-pledge/sa-2026003/
Metrics		cvssV3_1 `{'score': 8.2, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H'}`

MITRE

Status: PUBLISHED

Assigner: Insyde

Published: 2026-08-12T00:20:36.095Z

Updated: 2026-08-12T12:39:26.057Z

Reserved: 2026-04-17T06:07:36.576Z

Link: CVE-2026-6484

Vulnrichment

Updated: 2026-08-12T12:39:23.016Z

NVD

Status : Received

Published: 2026-08-12T01:17:08.060

Modified: 2026-08-12T13:17:24.500

Link: CVE-2026-6484

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-6484", "assignerOrgId": "8338d8cb-57f7-4252-abc0-96fd13e98d21", "state": "PUBLISHED", "assignerShortName": "Insyde", "dateReserved": "2026-04-17T06:07:36.576Z", "datePublished": "2026-08-12T00:20:36.095Z", "dateUpdated": "2026-08-12T12:39:26.057Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8338d8cb-57f7-4252-abc0-96fd13e98d21", "shortName": "Insyde", "dateUpdated": "2026-08-12T00:20:36.095Z"}, "title": "Lack of verified boot to certain FV may cause arbitrary code execution", "datePublic": "2026-08-12T00:04:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-1277", "description": "CWE-1277: Insufficient Verification of Data Authenticity in Firmware", "type": "CWE"}]}], "affected": [{"vendor": "Insyde Software", "product": "InsydeH2O", "platforms": ["x86"], "versions": [{"status": "unknown", "version": "See in the Solution"}], "defaultStatus": "unknown"}], "descriptions": [{"lang": "en", "value": "In an UEFI, Lack of verified boot to certain FV may cause arbitrary code execution.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "In an UEFI, Lack of verified boot to certain FV may cause arbitrary code execution."}]}], "references": [{"url": "https://www.insyde.com/security-pledge/sa-2026003/"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "HIGH", "baseScore": 8.2, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"}}], "solutions": [{"lang": "en", "value": "Intel Mobile Platforms:\nPanther Lake: Unaffected\nLunar Lake: Unaffected\nAarow Lake H/U: Version 05.56.17.0022\nAarow Lake S/HX: Version 05.56.17.0037\nRapter Lake: Version 05.47.24.0058\nTwin Lake: Version 05.44.45.0029\n\n\n\n\u00a0\n\n\n\nIntel Server/Embedded platforms:\nWhitley (CLX/CPX/ICX): Trunk\nCedarIsland (CPX): Trunk\nEagle Stream: Unaffected\nBirch Stream: Unaffected\nMehlow/Mehlow-R(CFL-S): Unaffected\nTatlow (RKS): Unaffected\nJacobsville(SNR): Trunk\nIdaville: Trunk\nKaseyville: Unaffected\nWhiskey Lake: Trunk\nCome tLake-S: Unaffected\nTiger Lake UP3/H: Unaffected\nAlder Lake: Version 05.47.24.2057\nRaptor Lake: Version 05.47.24.0057\nMeteor Lake \u2013 U/H ARL-H/U: Version 05.56.07.0022\nMeteor Lake \u2013 PS ARL-H/U: Version 05.56.07.0022\nArrow Lake \u2013 S ARL-S/HX: Version 05.55.45.0036\nArrow Lake \u2013 U/H ARL-H/U: Version 05.56.07.0022\nElkhart Lake: Version 05.48.17.0030\nAlder Lake N: Trunk\nAmston Lake: Trunk\nTwin Lake: Trunk", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p><strong>Intel Mobile Platforms:</strong><br>Panther Lake: Unaffected<br>Lunar Lake: Unaffected<br>Aarow Lake H/U: Version 05.56.17.0022<br>Aarow Lake S/HX: Version 05.56.17.0037<br>Rapter Lake: Version 05.47.24.0058<br>Twin Lake: Version 05.44.45.0029</p><p> </p><p><strong>Intel Server/Embedded platforms:<br></strong>Whitley (CLX/CPX/ICX): Trunk<br>CedarIsland (CPX): Trunk<br>Eagle Stream: Unaffected<br>Birch Stream: Unaffected<br>Mehlow/Mehlow-R(CFL-S): Unaffected<br>Tatlow (RKS): Unaffected<br>Jacobsville(SNR): Trunk<br>Idaville: Trunk<br>Kaseyville: Unaffected<br>Whiskey Lake: Trunk<br>Come tLake-S: Unaffected<br>Tiger Lake UP3/H: Unaffected<br>Alder Lake: Version 05.47.24.2057<br>Raptor Lake: Version 05.47.24.0057<br>Meteor Lake \u2013 U/H ARL-H/U: Version 05.56.07.0022<br>Meteor Lake \u2013 PS ARL-H/U: Version 05.56.07.0022<br>Arrow Lake \u2013 S ARL-S/HX: Version 05.55.45.0036<br>Arrow Lake \u2013 U/H ARL-H/U: Version 05.56.07.0022<br>Elkhart Lake: Version 05.48.17.0030<br>Alder Lake N: Trunk<br>Amston Lake: Trunk<br>Twin Lake: Trunk</p>"}]}], "credits": [{"lang": "en", "value": "Thanks to Nikolaj Schlej, independent firmware security researcher, for reporting the vulnerability and engaging in this coordinated disclosure.", "type": "reporter"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.4"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-12T12:39:19.055017Z", "id": "CVE-2026-6484", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-12T12:39:26.057Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-6484", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-12T12:39:19.055017Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-12T12:39:23.016Z"}}], "cna": {"title": "Lack of verified boot to certain FV may cause arbitrary code execution", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "reporter", "value": "Thanks to Nikolaj Schlej, independent firmware security researcher, for reporting the vulnerability and engaging in this coordinated disclosure."}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Insyde Software", "product": "InsydeH2O", "versions": [{"status": "unknown", "version": "See in the Solution"}], "platforms": ["x86"], "defaultStatus": "unknown"}], "solutions": [{"lang": "en", "value": "Intel Mobile Platforms:\nPanther Lake: Unaffected\nLunar Lake: Unaffected\nAarow Lake H/U: Version 05.56.17.0022\nAarow Lake S/HX: Version 05.56.17.0037\nRapter Lake: Version 05.47.24.0058\nTwin Lake: Version 05.44.45.0029\n\n\n\n\u00a0\n\n\n\nIntel Server/Embedded platforms:\nWhitley (CLX/CPX/ICX): Trunk\nCedarIsland (CPX): Trunk\nEagle Stream: Unaffected\nBirch Stream: Unaffected\nMehlow/Mehlow-R(CFL-S): Unaffected\nTatlow (RKS): Unaffected\nJacobsville(SNR): Trunk\nIdaville: Trunk\nKaseyville: Unaffected\nWhiskey Lake: Trunk\nCome tLake-S: Unaffected\nTiger Lake UP3/H: Unaffected\nAlder Lake: Version 05.47.24.2057\nRaptor Lake: Version 05.47.24.0057\nMeteor Lake \u2013 U/H ARL-H/U: Version 05.56.07.0022\nMeteor Lake \u2013 PS ARL-H/U: Version 05.56.07.0022\nArrow Lake \u2013 S ARL-S/HX: Version 05.55.45.0036\nArrow Lake \u2013 U/H ARL-H/U: Version 05.56.07.0022\nElkhart Lake: Version 05.48.17.0030\nAlder Lake N: Trunk\nAmston Lake: Trunk\nTwin Lake: Trunk", "supportingMedia": [{"type": "text/html", "value": "<p><strong>Intel Mobile Platforms:</strong><br>Panther Lake: Unaffected<br>Lunar Lake: Unaffected<br>Aarow Lake H/U: Version 05.56.17.0022<br>Aarow Lake S/HX: Version 05.56.17.0037<br>Rapter Lake: Version 05.47.24.0058<br>Twin Lake: Version 05.44.45.0029</p><p> </p><p><strong>Intel Server/Embedded platforms:<br></strong>Whitley (CLX/CPX/ICX): Trunk<br>CedarIsland (CPX): Trunk<br>Eagle Stream: Unaffected<br>Birch Stream: Unaffected<br>Mehlow/Mehlow-R(CFL-S): Unaffected<br>Tatlow (RKS): Unaffected<br>Jacobsville(SNR): Trunk<br>Idaville: Trunk<br>Kaseyville: Unaffected<br>Whiskey Lake: Trunk<br>Come tLake-S: Unaffected<br>Tiger Lake UP3/H: Unaffected<br>Alder Lake: Version 05.47.24.2057<br>Raptor Lake: Version 05.47.24.0057<br>Meteor Lake \u2013 U/H ARL-H/U: Version 05.56.07.0022<br>Meteor Lake \u2013 PS ARL-H/U: Version 05.56.07.0022<br>Arrow Lake \u2013 S ARL-S/HX: Version 05.55.45.0036<br>Arrow Lake \u2013 U/H ARL-H/U: Version 05.56.07.0022<br>Elkhart Lake: Version 05.48.17.0030<br>Alder Lake N: Trunk<br>Amston Lake: Trunk<br>Twin Lake: Trunk</p>", "base64": false}]}], "datePublic": "2026-08-12T00:04:00.000Z", "references": [{"url": "https://www.insyde.com/security-pledge/sa-2026003/"}], "x_generator": {"engine": "Vulnogram 1.0.4"}, "descriptions": [{"lang": "en", "value": "In an UEFI, Lack of verified boot to certain FV may cause arbitrary code execution.", "supportingMedia": [{"type": "text/html", "value": "In an UEFI, Lack of verified boot to certain FV may cause arbitrary code execution.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1277", "description": "CWE-1277: Insufficient Verification of Data Authenticity in Firmware"}]}], "providerMetadata": {"orgId": "8338d8cb-57f7-4252-abc0-96fd13e98d21", "shortName": "Insyde", "dateUpdated": "2026-08-12T00:20:36.095Z"}}}, "cveMetadata": {"cveId": "CVE-2026-6484", "state": "PUBLISHED", "dateUpdated": "2026-08-12T12:39:26.057Z", "dateReserved": "2026-04-17T06:07:36.576Z", "assignerOrgId": "8338d8cb-57f7-4252-abc0-96fd13e98d21", "datePublished": "2026-08-12T00:20:36.095Z", "assignerShortName": "Insyde"}, "dataVersion": "5.2"}