CVE-2025-12050highCWE-787

CVE-2025-12050: high-severity vulnerability in InsydeH2O tools

In H2OFFT32.sys is potentially vulnerable to a buffer overflow.

Published

Follow this CVE+ Monitor InsydeH2O tools

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.8epss 0.2%
The drivers in the tool packages use RTL_QUERY_REGISTRY_DIRECT flag to read a registry value to which an untrusted user-mode application may be able to cause a buffer overflow.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
Insyde Software · InsydeH2O tools
Related CVEs — InsydeH2O tools

In the same product, most dangerous first.

CVE-2025-12053HIGHegwindrvx64.sys is potentially vulnerable to a buffer overflowEPSS 0.2%CVE-2025-12052HIGHegwindrv.sys is potentially vulnerable to a buffer overflow.EPSS 0.2%CVE-2025-12051HIGHH2OFFT64.sys is potentially vulnerable to a buffer overflow.EPSS 0.2%