How many CVEs does Insyde have?

Insyde has 121 published CVE records since 2005, including 21 in the last two years.

How many Insyde CVEs are in CISA KEV?

None of Insyde's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Which Insyde products have the most CVEs?

The Insyde products with the most published CVEs are InsydeH2O, kernel, InsydeH2O tools, h2offt, insydeh20.

What are the most common weakness types in Insyde CVEs?

Insyde's CVEs most often map to these CWE weakness types: CWE-367 (Time-of-check Time-of-use (TOCTOU) Race Condition), CWE-787 (Out-of-bounds Write), CWE-20 (Improper Input Validation), CWE-121 (Stack-based Buffer Overflow).

Are there public exploits for Insyde vulnerabilities?

Yes — 9 of Insyde's CVEs have a known public exploit.

How many critical Insyde vulnerabilities are there?

Insyde has 4 critical and 89 high-severity CVEs.

What is the average severity of Insyde CVEs?

The average CVSS base score across Insyde's scored CVEs is 7.4.

RadicalNotion.AI

Log in Start free

Log in

Log in Start free

121 CVEs

Insyde Vulnerabilities

Name: Insyde vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE security advisories and vulnerability history for Insyde.

121

Total CVEs

Published

0

In CISA KEV

Exploited in the wild

9

Public exploits

PoC or exploit code

7.4

Avg CVSS

2005–2026

Overview

Insyde has 121 published CVE records since 2005, of which 0 are in CISA's Known Exploited Vulnerabilities catalog and 9 have a known public exploit. The average CVSS base score across scored CVEs is 7.4.

This page aggregates every publicly disclosed vulnerability (CVE) affecting Insyde products, with severity breakdowns, the most-affected products, the most common weakness types, and the latest disclosures.

Security scorecard

A quick read on Insyde's vulnerability posture, as a share of its 121 published CVEs.

Average CVSS: 7.4
Critical / high: 77%
Actively exploited (KEV): 0%
Public exploit available: 7%
Patch available: 82%

Severity and exploitation

How the CVSS severity of Insyde's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical4

High89

Medium27

Low1

In CISA’s Known Exploited Vulnerabilities catalog

0

None of Insyde's CVEs are currently listed in CISA's KEV catalog.

Public exploits

9

9 of Insyde's CVEs have a known public exploit available.

Most affected products

The Insyde products with the most published CVEs. Follow any product to browse its versions and vulnerabilities.

Common weakness types

The CWE weakness categories most often found in Insyde CVEs. Follow any weakness for its full explanation.

CNAs that assign these CVEs

The CVE Numbering Authorities that publish Insyde CVE records.

Disclosure activity by year

How many Insyde CVEs were published each year.

2005

1

2019

1

2021

4

2022

57

2023

31

2024

6

2025

17

2026

4

Latest Insyde CVEs

The most recently disclosed vulnerabilities affecting Insyde.

egwindrvx64.sys is potentially vulnerable to a buffer overflow
CWE-787
High · CVSS 7.8
EPSS 0.1%2026-01-14
egwindrv.sys is potentially vulnerable to a buffer overflow.
CWE-787
High · CVSS 7.8
EPSS 0.1%2026-01-14
H2OFFT64.sys is potentially vulnerable to a buffer overflow.
CWE-787
High · CVSS 7.8
EPSS 0.2%2026-01-14
In H2OFFT32.sys is potentially vulnerable to a buffer overflow.
CWE-787
High · CVSS 7.8
EPSS 0.2%2026-01-14
H19Int15CallbackSmm: SMM memory corruption vulnerability in combined DXE/SMM (SMRAM write)
CWE-787
High · CVSS 8.2
EPSS 0.1%2025-12-12
SetupUtility: A buffer overflow vulnerability leads to arbitrary code execution.
CWE-20
High · CVSS 7.5
EPSS 0.1%2025-08-13
Tcg2Smm: improper input validation may lead to arbitrary code execution
CWE-20
High · CVSS 7.5
EPSS 0.1%2025-08-13
UsbCoreDxe: improper input validation may lead to arbitrary code execution
CWE-20
High · CVSS 7.5
EPSS 0.1%2025-08-13
SetupAutomationSmm : SMRAM memory contents leak / information disclosure vulnerability in SMM module
CWE-200
Medium · CVSS 6.0
EPSS 0.2%2025-07-30
SetupAutomationSmm: Stack overflow vulnerability in SMI handler
CWE-121
High · CVSS 8.2
EPSS 0.2%2025-07-30
SetupAutomationSmm : Arbitrary calls to SmmSetVariable with unsanitised arguments in SMI handler
CWE-20
Medium · CVSS 6.0
EPSS 0.2%2025-07-30
SetupAutomationSmm:Vulnerability in the SMM module allow attacker to write arbitrary code and lead to memory corruption
CWE-119
High · CVSS 8.2
EPSS 0.2%2025-07-30

Track new Insyde CVEs as they are disclosed and get AI-written analysis and remediation guidance.

Monitor Insyde CVEs

Other vendors

Browse vulnerabilities for other tracked vendors.

Zimbra122 CVEs automattic121 CVEs Bosch121 CVEs GraphicsMagick121 CVEs themeisle121 CVEs ui120 CVEs webmin120 CVEs netscape120 CVEs

Browse all vendors

Frequently asked questions

Common questions about Insyde vulnerabilities.

How many CVEs does Insyde have?: Insyde has 121 published CVE records since 2005, including 21 in the last two years.
How many Insyde CVEs are in CISA KEV?: None of Insyde's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.
Which Insyde products have the most CVEs?: The Insyde products with the most published CVEs are InsydeH2O, kernel, InsydeH2O tools, h2offt, insydeh20.
What are the most common weakness types in Insyde CVEs?: Insyde's CVEs most often map to these CWE weakness types: CWE-367 (Time-of-check Time-of-use (TOCTOU) Race Condition), CWE-787 (Out-of-bounds Write), CWE-20 (Improper Input Validation), CWE-121 (Stack-based Buffer Overflow).
Are there public exploits for Insyde vulnerabilities?: Yes — 9 of Insyde's CVEs have a known public exploit.
How many critical Insyde vulnerabilities are there?: Insyde has 4 critical and 89 high-severity CVEs.
What is the average severity of Insyde CVEs?: The average CVSS base score across Insyde's scored CVEs is 7.4.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track Insyde vulnerabilities

Monitor new Insyde vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing