Description
A vulnerability in the digital signature verification process does not properly validate variable attributes which allows an attacker to bypass signature verification by creating a non-authenticated NVRAM variable. An attacker may to execute arbitrary signed UEFI code and bypass Secure Boot.
Metrics
CVSS 3.1 7.8/10
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:HAffected software
| Vendor | Product | Versions |
|---|---|---|
| Insyde Software | InsydeH2O | >= Kernel 5.2, < 05.2A.16; >= Kernel 5.3, < 05.39.16; >= Kernel 5.4, < 05.47.16; >= Kernel 5.5, < 05.55.16; >= Kernel 5.6, < 05.62.16; >= Kernel 5.7, < 05.71.16 |
References
Timeline
- Published
- Jun 11, 2025
- Last modified
- Jun 17, 2026
- NVD status
- Deferred