Description
The drivers in the tool packages use RTL_QUERY_REGISTRY_DIRECT flag to read a registry value to which an untrusted user-mode application may be able to cause a buffer overflow.
Published: 2026-01-14
Score: 7.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

Vendor Solution

H2OFFT (mobile) version  6.76.00 OEM tools: HP FlashWin version 6.51.00 HP Readback tool version 1.2.4.0 HP FlashVerifyUtility version 6.2.5.0 IsSecureBootKeyInstaller version 1.2.0.2

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 14 Jan 2026 11:15:00 +0000

Type Values Removed Values Added
First Time appeared Insyde
Insyde insydeh2o
Vendors & Products Insyde
Insyde insydeh2o

Wed, 14 Jan 2026 01:15:00 +0000

Type Values Removed Values Added
Description The drivers in the tool packages use RTL_QUERY_REGISTRY_DIRECT flag to read a registry value to which an untrusted user-mode application may be able to cause a buffer overflow.
Title In H2OFFT32.sys is potentially vulnerable to a buffer overflow.
Weaknesses CWE-787
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Insyde Insydeh2o
cve-icon MITRE

Status: PUBLISHED

Assigner: Insyde

Published:

Updated: 2026-01-14T23:26:28.947Z

Reserved: 2025-10-22T02:22:12.124Z

Link: CVE-2025-12050

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-01-14T01:15:49.743

Modified: 2026-04-15T00:35:42.020

Link: CVE-2025-12050

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-01-14T10:48:48Z

Weaknesses