CVE-2022-32474

CVE-2022-32474 affects Insyde InsydeH2O firmware kernels 5.0 through 5.5. It describes a Time-of-Check to Time-of-Use (TOCTOU) race condition vulnerability arising from DMA attacks on a shared buffer between SMM and non-SMM code. This flaw carries a CVSSv3.1 score of 7.0 (HIGH), indicating that a local attacker with low privileges and high attack complexity could achieve SMRAM corruption and privilege escalation. While the vulnerability is significant, there is currently no evidence of active exploitation, publicly available exploit code, or notable community discussion or media coverage.