---
id: CVE-2021-45969
title: >-
  An issue was discovered in AhciBusDxe in Insyde InsydeH2O with kernel 5.1
  before 05.16.25, 5.2 before 05.26.25, 5.3 before 05.35.25, 5.4 before
  05.43.25, and 5.5 before 05.51.25
summary: >-
  An issue was discovered in AhciBusDxe in Insyde InsydeH2O with kernel 5.1
  before 05.16.25, 5.2 before 05.26.25, 5.3 before 05.35.25, 5.4 before
  05.43.25, and 5.5 before 05.51.25. A vulnerability exists in the SMM (System
  Management Mode)…
severity: high
cvss: 8.2
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H'
cwe:
  - CWE-787
vendor: insyde
product: insydeh2o
affected:
  - 'insydeh2o >= 5.1, < 5.16.25'
  - 'insydeh2o >= 5.2, < 5.26.25'
  - 'insydeh2o >= 5.3, < 5.35.25'
  - 'insydeh2o >= 5.4, < 5.43.25'
  - 'insydeh2o >= 5.5, < 05.51.25'
patched:
  - insydeh2o 05.51.25
published: '2022-01-05'
updated: '2026-08-11'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2021-45969'
references:
  - url: 'https://cert-portal.siemens.com/productcert/pdf/ssa-306654.pdf'
    label: cve@mitre.org
  - url: 'https://security.netapp.com/advisory/ntap-20220216-0004/'
    label: cve@mitre.org
  - url: 'https://www.insyde.com/security-pledge'
    label: cve@mitre.org
  - url: 'https://cert-portal.siemens.com/productcert/pdf/ssa-306654.pdf'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://security.netapp.com/advisory/ntap-20220216-0004/'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://www.insyde.com/security-pledge'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://www.kb.cert.org/vuls/id/796611'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-306654.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
tags:
  - nvd
epss: 0.00279
epssPercentile: 0.20676
ingestedAt: '2026-08-11T16:47:01.517Z'
---

## Overview

An issue was discovered in AhciBusDxe in Insyde InsydeH2O with kernel 5.1 before 05.16.25, 5.2 before 05.26.25, 5.3 before 05.35.25, 5.4 before 05.43.25, and 5.5 before 05.51.25. A vulnerability exists in the SMM (System Management Mode) branch that registers a SWSMI handler that does not sufficiently check or validate the allocated buffer pointer (the CommBuffer+8 location).

## Affected

- `insydeh2o >= 5.1, < 5.16.25`
- `insydeh2o >= 5.2, < 5.26.25`
- `insydeh2o >= 5.3, < 5.35.25`
- `insydeh2o >= 5.4, < 5.43.25`
- `insydeh2o >= 5.5, < 05.51.25`

## Remediation

Upgrade past the affected range:

- `insydeh2o 05.51.25`