{"history":[{"alert":0,"cve":"CVE-2026-12855","id":23229,"kind":"epss","observed_at":1794500401,"payload":"{\"date\": \"2026-11-12\", \"epss\": 0.00184, \"percentile\": 0.08078}"},{"alert":0,"cve":"CVE-2026-12855","id":20707,"kind":"epss","observed_at":1794327601,"payload":"{\"date\": \"2026-11-10\", \"epss\": 0.00184, \"percentile\": 0.08061}"},{"alert":0,"cve":"CVE-2026-12855","id":18545,"kind":"epss","observed_at":1794241201,"payload":"{\"date\": \"2026-11-09\", \"epss\": 0.00184, \"percentile\": 0.08031}"},{"alert":0,"cve":"CVE-2026-12855","id":16616,"kind":"epss","observed_at":1794154800,"payload":"{\"date\": \"2026-11-08\", \"epss\": 0.00184, \"percentile\": 0.08036}"},{"alert":0,"cve":"CVE-2026-12855","id":14594,"kind":"epss","observed_at":1794068402,"payload":"{\"date\": \"2026-11-07\", \"epss\": 0.00184, \"percentile\": 0.08043}"},{"alert":0,"cve":"CVE-2026-12855","id":12376,"kind":"epss","observed_at":1793982001,"payload":"{\"date\": \"2026-11-06\", \"epss\": 0.00184, \"percentile\": 0.08056}"},{"alert":0,"cve":"CVE-2026-12855","id":10364,"kind":"epss","observed_at":1793938800,"payload":"{\"date\": \"2026-11-05\", \"epss\": 0.00184, \"percentile\": 0.08078}"},{"alert":0,"cve":"CVE-2026-12855","id":7914,"kind":"epss","observed_at":1793809200,"payload":"{\"date\": \"2026-11-04\", \"epss\": 0.00184, \"percentile\": 0.08078}"},{"alert":0,"cve":"CVE-2026-12855","id":5694,"kind":"epss","observed_at":1793722800,"payload":"{\"date\": \"2026-11-03\", \"epss\": 0.00184, \"percentile\": 0.08055}"},{"alert":0,"cve":"CVE-2026-12855","id":3523,"kind":"epss","observed_at":1793665375,"payload":"{\"date\": \"2026-11-02\", \"epss\": 0.00184, \"percentile\": 0.08002}"},{"alert":1,"cve":"CVE-2026-12855","id":1796,"kind":"cna","observed_at":1793665375,"payload":"{\"containers\": {\"adp\": [{\"metrics\": [{\"other\": {\"content\": {\"id\": \"CVE-2026-12855\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"role\": \"CISA Coordinator\", \"timestamp\": \"2026-09-09T15:54:34.074995Z\", \"version\": \"2.0.3\"}, \"type\": \"ssvc\"}}], \"providerMetadata\": {\"dateUpdated\": \"2026-09-09T20:51:33.091Z\", \"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\"}, \"title\": \"CISA ADP Vulnrichment\"}, {\"providerMetadata\": {\"dateUpdated\": \"2026-10-01T15:08:22.356Z\", \"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\"}, \"references\": [{\"url\": \"https://www.kb.cert.org/vuls/id/553437\"}], \"title\": \"CVE Program Container\"}], \"cna\": {\"affected\": [{\"defaultStatus\": \"unaffected\", \"platforms\": [\"x86\"], \"product\": \"InsydeH2O\", \"vendor\": \"Insyde Software\", \"versions\": [{\"status\": \"affected\", \"version\": \"See in the Solution\"}]}], \"datePublic\": \"2026-09-09T03:56:00.000Z\", \"descriptions\": [{\"lang\": \"en\", \"supportingMedia\": [{\"base64\": false, \"type\": \"text/html\", \"value\": \"Unvalidated memory boundary could result in arbitrary code execution. The vulnerability exists in the code developed specifically for HP projects.\"}], \"value\": \"Unvalidated memory boundary could result in arbitrary code execution. The vulnerability exists in the code developed specifically for HP projects.\"}], \"metrics\": [{\"cvssV3_1\": {\"attackComplexity\": \"LOW\", \"attackVector\": \"LOCAL\", \"availabilityImpact\": \"HIGH\", \"baseScore\": 8.2, \"baseSeverity\": \"HIGH\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"privilegesRequired\": \"HIGH\", \"scope\": \"CHANGED\", \"userInteraction\": \"NONE\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H\", \"version\": \"3.1\"}, \"format\": \"CVSS\", \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-20\", \"description\": \"CWE-20: Improper Input Validation\", \"lang\": \"en\", \"type\": \"CWE\"}]}], \"providerMetadata\": {\"dateUpdated\": \"2026-09-09T03:59:11.348Z\", \"orgId\": \"8338d8cb-57f7-4252-abc0-96fd13e98d21\", \"shortName\": \"Insyde\"}, \"references\": [{\"url\": \"https://www.insyde.com/security-pledge/sa-2026009/\"}], \"solutions\": [{\"lang\": \"en\", \"supportingMedia\": [{\"base64\": false, \"type\": \"text/html\", \"value\": \"HP feature version<br>\\u2013 Platform 5.4: 05.47.2701.2631<br>\\u2013 Platform 5.5: 05.55.45.2630<br>\\u2013 Platform 5.6: 05.62.29.2630<br>\\u2013 Platform 5.7: 05.72.21.2630<br>\\u2013 Platform 6.0: 06.01.23.2630\"}], \"value\": \"HP feature version\\n\\u2013 Platform 5.4: 05.47.2701.2631\\n\\u2013 Platform 5.5: 05.55.45.2630\\n\\u2013 Platform 5.6: 05.62.29.2630\\n\\u2013 Platform 5.7: 05.72.21.2630\\n\\u2013 Platform 6.0: 06.01.23.2630\"}], \"source\": {\"discovery\": \"UNKNOWN\"}, \"title\": \"H19WMIHandlerSmm: unvalidated memory boundary could result in arbitrary code execution.\", \"x_generator\": {\"engine\": \"Vulnogram 1.0.5\"}}}, \"cveMetadata\": {\"assignerOrgId\": \"8338d8cb-57f7-4252-abc0-96fd13e98d21\", \"assignerShortName\": \"Insyde\", \"cveId\": \"CVE-2026-12855\", \"datePublished\": \"2026-09-09T03:59:11.348Z\", \"dateReserved\": \"2026-06-22T05:49:02.853Z\", \"dateUpdated\": \"2026-10-01T15:08:22.356Z\", \"state\": \"PUBLISHED\"}, \"dataType\": \"CVE_RECORD\", \"dataVersion\": \"5.2\"}"}],"record":{"affected":[{"defaultStatus":"unaffected","platforms":["x86"],"product":"InsydeH2O","vendor":"Insyde Software","versions":[{"status":"affected","version":"See in the Solution"}]}],"cna":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-12855","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2026-09-09T15:54:34.074995Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-09-09T20:51:33.091Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"},{"providerMetadata":{"dateUpdated":"2026-10-01T15:08:22.356Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"url":"https://www.kb.cert.org/vuls/id/553437"}],"title":"CVE Program Container"}],"cna":{"affected":[{"defaultStatus":"unaffected","platforms":["x86"],"product":"InsydeH2O","vendor":"Insyde Software","versions":[{"status":"affected","version":"See in the Solution"}]}],"datePublic":"2026-09-09T03:56:00.000Z","descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Unvalidated memory boundary could result in arbitrary code execution. The vulnerability exists in the code developed specifically for HP projects."}],"value":"Unvalidated memory boundary could result in arbitrary code execution. The vulnerability exists in the code developed specifically for HP projects."}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-20","description":"CWE-20: Improper Input Validation","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-09-09T03:59:11.348Z","orgId":"8338d8cb-57f7-4252-abc0-96fd13e98d21","shortName":"Insyde"},"references":[{"url":"https://www.insyde.com/security-pledge/sa-2026009/"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"HP feature version<br>\u2013 Platform 5.4: 05.47.2701.2631<br>\u2013 Platform 5.5: 05.55.45.2630<br>\u2013 Platform 5.6: 05.62.29.2630<br>\u2013 Platform 5.7: 05.72.21.2630<br>\u2013 Platform 6.0: 06.01.23.2630"}],"value":"HP feature version\n\u2013 Platform 5.4: 05.47.2701.2631\n\u2013 Platform 5.5: 05.55.45.2630\n\u2013 Platform 5.6: 05.62.29.2630\n\u2013 Platform 5.7: 05.72.21.2630\n\u2013 Platform 6.0: 06.01.23.2630"}],"source":{"discovery":"UNKNOWN"},"title":"H19WMIHandlerSmm: unvalidated memory boundary could result in arbitrary code execution.","x_generator":{"engine":"Vulnogram 1.0.5"}}},"cveMetadata":{"assignerOrgId":"8338d8cb-57f7-4252-abc0-96fd13e98d21","assignerShortName":"Insyde","cveId":"CVE-2026-12855","datePublished":"2026-09-09T03:59:11.348Z","dateReserved":"2026-06-22T05:49:02.853Z","dateUpdated":"2026-10-01T15:08:22.356Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"cna_checked":1794522003,"cve":"CVE-2026-12855","description":"Unvalidated memory boundary could result in arbitrary code execution. The vulnerability exists in the code developed specifically for HP projects.","epss":{"date":"2026-11-12","epss":0.00184,"percentile":0.08078},"epss_checked":1794522003,"first_seen":1793665374,"kev":null,"kev_checked":1794522003,"products":"Insyde Software InsydeH2O","references":["https://www.insyde.com/security-pledge/sa-2026009/","https://www.kb.cert.org/vuls/id/553437"],"score":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":8.2,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","provider":"Insyde","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"solutions":"HP feature version\n\u2013 Platform 5.4: 05.47.2701.2631\n\u2013 Platform 5.5: 05.55.45.2630\n\u2013 Platform 5.6: 05.62.29.2630\n\u2013 Platform 5.7: 05.72.21.2630\n\u2013 Platform 6.0: 06.01.23.2630","state":"PUBLISHED","title":"H19WMIHandlerSmm: unvalidated memory boundary could result in arbitrary code execution.","updated_at":1794500401,"workarounds":""},"sources":[{"canonical_url":"https://kb.cert.org/vuls/id/553437","id":179,"publisher":"CERT/CC","title":"VU#553437: InsydeH2O IHISI SMM is vulnerable to unsafe memory write operations"}]}