CVE-2026-9805: H2O SMM buffer overflow

CISO Take

This is a buffer overflow (CWE-787) in the SMM command handler FMTSWriteUseIntelLib of InsydeH2O UEFI firmware, triggered via IHISI FMTS command 0x32, which reads and writes data without validating buffer size. The exploitation chain is unusually constrained: it needs physical access, an attacker who already has high privileges, high attack complexity, and user interaction — CVSS 2.7 reflects that friction, and there's no EPSS score, no CISA KEV listing, no public exploit, and no scanner template, so nothing suggests active or imminent exploitation at scale. The real concern is not mass exploitation but targeted persistence: SMM executes beneath the OS and hypervisor, so a successful exploit on hardware running AI training or inference workloads could plant a firmware implant invisible to host-based AI security tooling and surviving OS reinstalls. Action: track OEM firmware/BIOS updates referencing Insyde advisory SA-2026006, inventory which AI infrastructure (GPU servers, edge AI appliances) runs InsydeH2O-based firmware, and prioritize physical access controls over network-based detection, since this bug isn't remotely reachable.

Sources:NVDinsyde.comATLASOpenSSF

What is the risk?

Overall risk is low in practice: CVSS 2.7, AV:P (physical), AC:H, PR:H and UI:R stack four independent prerequisites that make opportunistic or remote exploitation implausible. No EPSS percentile, no KEV entry, no public exploit or Nuclei template exist, so there is no evidence of real-world targeting. However, the technical severity of a successful exploit is disproportionate to its CVSS score: SMM (ring -2) compromise sits below OS and hypervisor visibility, so if this ever is chained with an initial-access vector that grants an attacker high local privileges plus physical proximity (e.g., insider threat, evil-maid attack on an edge device, or a compromised OEM/refurbishment supply chain), the resulting implant would be extremely persistent and hard to detect. 27 downstream dependents and an OpenSSF Scorecard of 5.7/10 indicate this firmware base has moderate reach and only middling supply-chain hygiene, and 18 other CVEs in the same codebase suggest a pattern of similar low-level parsing issues worth tracking rather than a one-off.

How does the attack unfold?

Physical Access

Attacker with existing high local privileges obtains brief physical access to hardware running AI training/inference workloads.

AML.T0041

Privileged SMI Trigger

Attacker invokes the IHISI interface to send FMTS command 0x32 to the SMM handler, requiring user interaction to complete the trigger.

SMM Buffer Overflow

Oversized data passed to FMTSWriteUseIntelLib overflows the buffer, corrupting memory within System Management Mode (ring -2).

Persistent Firmware Implant

Attacker plants an implant beneath the OS/hypervisor that survives reinstalls, threatening the integrity of any AI workload the machine later runs.

Physical Access

Attacker with existing high local privileges obtains brief physical access to hardware running AI training/inference workloads.

AML.T0041

Privileged SMI Trigger

Attacker invokes the IHISI interface to send FMTS command 0x32 to the SMM handler, requiring user interaction to complete the trigger.

SMM Buffer Overflow

Oversized data passed to FMTSWriteUseIntelLib overflows the buffer, corrupting memory within System Management Mode (ring -2).

Persistent Firmware Implant

Attacker plants an implant beneath the OS/hypervisor that survives reinstalls, threatening the integrity of any AI workload the machine later runs.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
H2O	pip	—	No patch
7.5KOpenSSF 5.727 dependentsPushed 11d ago8% patched~0d to patchFull package profile →

Do you use H2O? You're affected.

How severe is it?

CVSS 3.1

2.7 / 10

EPSS

0.1%

chance of exploitation in 30 days

Higher than 3% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Advanced

What is the attack surface?

AVPhysical

ACHigh

PRHigh

UIRequired

SUnchanged

CNone

ILow

ALow

What should I do?

1 step

Apply the OEM BIOS/UEFI firmware update referencing Insyde security advisory SA-2026006 as soon as your hardware vendor publishes it — this is a firmware patch, not a package/library update, so it must be tracked through OEM release notes rather than pip/npm advisories. Inventory which servers and edge devices hosting AI/ML workloads run InsydeH2O firmware and prioritize patching those with the least physical access control (colo racks, edge/branch deployments, shared-tenant environments). Given the physical-access precondition, harden physical security (chassis intrusion detection, secured racks, custody logs) for AI training/inference hardware as the primary control. Where available, use firmware integrity attestation/measurement tooling (e.g., TPM-based measured boot, Intel/AMD platform attestation) to detect unauthorized firmware modification; network-based detection is not applicable since this vulnerability has no remote attack vector.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code ExecutionDoSInferenceTraining DataAML.T0041- Physical Environment Access

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, Robustness and Cybersecurity

Frequently Asked Questions

What is CVE-2026-9805?

This is a buffer overflow (CWE-787) in the SMM command handler FMTSWriteUseIntelLib of InsydeH2O UEFI firmware, triggered via IHISI FMTS command 0x32, which reads and writes data without validating buffer size. The exploitation chain is unusually constrained: it needs physical access, an attacker who already has high privileges, high attack complexity, and user interaction — CVSS 2.7 reflects that friction, and there's no EPSS score, no CISA KEV listing, no public exploit, and no scanner template, so nothing suggests active or imminent exploitation at scale. The real concern is not mass exploitation but targeted persistence: SMM executes beneath the OS and hypervisor, so a successful exploit on hardware running AI training or inference workloads could plant a firmware implant invisible to host-based AI security tooling and surviving OS reinstalls. Action: track OEM firmware/BIOS updates referencing Insyde advisory SA-2026006, inventory which AI infrastructure (GPU servers, edge AI appliances) runs InsydeH2O-based firmware, and prioritize physical access controls over network-based detection, since this bug isn't remotely reachable.

Is CVE-2026-9805 actively exploited?

No confirmed active exploitation of CVE-2026-9805 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-9805?

Apply the OEM BIOS/UEFI firmware update referencing Insyde security advisory SA-2026006 as soon as your hardware vendor publishes it — this is a firmware patch, not a package/library update, so it must be tracked through OEM release notes rather than pip/npm advisories. Inventory which servers and edge devices hosting AI/ML workloads run InsydeH2O firmware and prioritize patching those with the least physical access control (colo racks, edge/branch deployments, shared-tenant environments). Given the physical-access precondition, harden physical security (chassis intrusion detection, secured racks, custody logs) for AI training/inference hardware as the primary control. Where available, use firmware integrity attestation/measurement tooling (e.g., TPM-based measured boot, Intel/AMD platform attestation) to detect unauthorized firmware modification; network-based detection is not applicable since this vulnerability has no remote attack vector.

What systems are affected by CVE-2026-9805?

This vulnerability affects the following AI/ML architecture patterns: model serving, training pipelines.

What is the CVSS score for CVE-2026-9805?

CVE-2026-9805 has a CVSS v3.1 base score of 2.7 (LOW). The EPSS exploitation probability is 0.13%.

What is the AI security impact?

Affected AI Architectures

model servingtraining pipelines

MITRE ATLAS Techniques

AML.T0041Physical Environment Access

Compliance Controls Affected

EU AI Act: Article 15

What are the technical details?

Original Advisory

SMM IHISI command handler, FMTSWriteUseIntelLib, for FMTS command 0x32, read and write data without checking buffer size and could cause buffer overflow.

Exploitation Scenario

An attacker who already holds high local privileges on a target machine (e.g., via a prior compromise or as a malicious insider) and gains brief physical access to an AI training or inference server — during maintenance, a hardware refresh, or at an edge deployment site — sends a crafted IHISI FMTS command (opcode 0x32) with an oversized payload to FMTSWriteUseIntelLib. The missing buffer-size check causes an out-of-bounds read/write inside System Management Mode, corrupting SMM memory at ring -2, below the OS and hypervisor. A successful exploit plants a persistent implant invisible to host-based AI security tooling and EDR, capable of surviving OS reinstalls and intercepting secrets (API keys, credentials) or tampering with the integrity of anything the machine subsequently runs — including AI training jobs or inference services hosted on that hardware.

Weaknesses (CWE)

CWE-787Out-of-bounds Write

CWE-787 — Out-of-bounds Write: The product writes data past the end, or before the beginning, of the intended buffer.

[Requirements] Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. For example, many languages that perform their own memory management, such as Java and Perl, are not subject to buffer overflows. Other languages, such as Ada and C#, typically provide overflow protection, but the protection can be disabled by the programmer. Be wary that a language's interface to native code may still be subject to overflows, even if the language itself is theoretically safe.
[Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. Examples include the Safe C String Library (SafeStr) by Messier and Viega [REF-57], and the Strsafe.h library from Microsoft [REF-56]. These libraries provide safer versions of overflow-prone string-handling functions.

Source: MITRE CWE corpus.