CVE-2024-25079

HighCVSS 7.4/10Last modified Jun 17, 2026

Description

A memory corruption vulnerability in HddPassword in Insyde InsydeH2O kernel 5.2 before 05.29.09, kernel 5.3 before 05.38.09, kernel 5.4 before 05.46.09, kernel 5.5 before 05.54.09, and kernel 5.6 before 05.61.09 could lead to escalating privileges in SMM.

Metrics

CVSS 3.1 7.4/10CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:L

Weakness enumeration

CWE-763

Affected software

No affected versions have been published.

Timeline

Published: May 15, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-25085.3The WP Mobile Menu plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_men CVE-2024-250804.7WebMail in Axigen 10.x before 10.3.3.62 allows XSS via the image attachment viewer.CVE-2024-250814.2Splinefont in FontForge through 20230101 allows command injection via crafted filenames.CVE-2024-250826.5Splinefont in FontForge through 20230101 allows command injection via crafted archives or compressed files.CVE-2024-250837.8An issue was discovered in BeyondTrust Privilege Management for Windows before 24.1. When an low-privileged user initiates a repair, there i CVE-2024-250867.8Improper privilege management in Jungo WinDriver before 12.2.0 allows local attackers to escalate privileges and execute arbitrary code.CVE-2024-250875.5Denial of Service (DoS) vulnerability in Jungo WinDriver before 12.7.0 allows local attackers to cause a Windows blue screen error.CVE-2024-250887.8Improper privilege management in Jungo WinDriver before 12.5.1 allows local attackers to escalate privileges and execute arbitrary code.CVE-2024-250899.8Malwarebytes Binisoft Windows Firewall Control before 6.9.9.2 allows remote attackers to execute arbitrary code via gRPC named pipes.CVE-2024-25096.5The Gutenberg Blocks by Kadence Blocks WordPress plugin before 3.2.26 does not validate and escape some of its block options before outputti CVE-2024-250905.4Insufficient input validation and sanitation in Profile name & screenname, Bookmark name & description and blogroll name features in all ver CVE-2024-250919.1Protection mechanism failure issue exists in RevoWorks SCVX prior to scvimage4.10.21_1013 (when using 'VirusChecker' or 'ThreatChecker' feat