First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2021-43614

MediumCVSS 6.7/10Last modified Sep 3, 2026

Description

Error in handling the PlatformLangCodes UEFI variable could cause a buffer overflow, leading to resource exhaustion and failure.

Metrics

CVSS 3.1 6.7/10CVSS:3.1/AV:P/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:L

Weakness enumeration

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Insyde Software	InsydeH2O	>= InsydeH2OUvePkg, < 01.01.04.0008

References

https://www.insyde.com/security-pledge/sa-2022026/

Timeline

Published: Sep 3, 2026
Last modified: Sep 3, 2026
NVD status: Undergoing Analysis

Related CVEs from 2021

CVE-2021-436158.2An issue was discovered in HddPassword in Insyde InsydeH2O with kernel 5.1 before 05.16.23, 5.2 before 05.26.23, 5.3 before 05.35.23, 5.4 be CVE-2021-436169.8The npm ci command in npm 7.x and 8.x through 8.1.3 proceeds with an installation even if dependency information in package-lock.json differ CVE-2021-436179.8Laravel Framework through 8.70.2 does not sufficiently block the upload of executable PHP content because Illuminate/Validation/Concerns/Val CVE-2021-436187.5GNU Multiple Precision Arithmetic Library (GMP) through 6.2.1 has an mpz/inp_raw.c integer overflow and resultant buffer overflow via crafte CVE-2021-436197.8Trusted Firmware M 1.4.x through 1.4.1 has a buffer overflow issue in the Firmware Update partition. In the IPC model, a psa_fwu_write calle CVE-2021-43629.8The Kiwi Social Share plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the kiwi_social_share_CVE-2021-436207.5An issue was discovered in the fruity crate through 0.2.0 for Rust. Security-relevant validation of filename extensions is plausibly affecte CVE-2021-436289.8Projectworlds Hospital Management System v1.0 is vulnerable to SQL injection via the email parameter in hms-staff.php.CVE-2021-436299.8Projectworlds Hospital Management System v1.0 is vulnerable to SQL injection via multiple parameters in admin_home.php.CVE-2021-43636.1The WP Quick FrontEnd Editor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 5.5 due CVE-2021-436308.8Projectworlds Hospital Management System v1.0 is vulnerable to SQL injection via multiple parameters in add_patient.php. As a result, an aut CVE-2021-436319.8Projectworlds Hospital Management System v1.0 is vulnerable to SQL injection via the appointment_no parameter in payment.php.

CVE-2021-43614: Medium severity, CVSS 6.7 | Vulnix