Insyde InsydeH2O Firmware Security Advisory: CVE-2026-6484 UEFI Boot Validation Issue

Insyde SA-2026003 Vulnerability Summary Vulnerability Overview Vulnerability ID: CVE-2026-6484 CVSS Score: 8.2 Description: In certain firmware (FV), a lack of verification during boot can lead to arbitrary code execution. CWE ID: CWE-1277 (Insufficient data authenticity verification in firmware) Affected Scope Product: InsydeH2O Affected Platforms: - Intel Mobile Platforms: - Panther Lake: Not Affected - Lunar Lake: Not Affected - Arrow Lake H/U: Version 05.56.17.0022 - Arrow Lake S/HX: Version 05.56.17.0037 - Raptor Lake: Version 05.47.24.0058 - Twin Lake: Version 05.44.45.0029 - Intel Server/Embedded Platforms: - Whitley (CLX/CPX/ICX): Trunk - Cedar Island (CPX): Trunk - Eagle Stream: Not Affected - Birch Stream: Not Affected - Mehlow/Mehlow-R (CFL-S): Not Affected - Taitow (RKS): Not Affected - Jacobsville (SNR): Trunk - Idaville: Trunk - Kaseyville: Not Affected - Whiskey Lake: Trunk - Comet Lake-S: Not Affected - Tiger Lake UP3/H: Not Affected - Alder Lake: Version 05.47.24.2057 - Raptor Lake: Version 05.47.24.0057 - Meteor Lake - U/H ARL-H/U: Version 05.56.07.0022 - Meteor Lake - PS ARL-H/U: Version 05.56.07.0022 - Arrow Lake - S ARL-S/HX: Version 05.55.45.0036 - Arrow Lake - U/H ARL-H/U: Version 05.56.07.0022 - Elkhart Lake: Version 05.48.17.0030 - Alder Lake N: Trunk - Amston Lake: Trunk - Twin Lake: Trunk Remediation Solution Information: - Firmware updates for specific versions are provided to remediate the vulnerability. - Users are advised to check and update their firmware to the safe versions listed above. Acknowledgments Thanks to independent firmware security researcher Nikolaj Schlej for reporting this vulnerability and participating in coordinated disclosure. Revision History Revision #1: 2026-08-11 Initial Release

Goal Reached Thanks to every supporter — we hit 100%!

Insyde InsydeH2O Firmware Security Advisory: CVE-2026-6484 UEFI Boot Validation Issue