A critical Out-of-bounds Write vulnerability exists in InsydeH2O IHISI software used by HP PC BIOS. This flaw allows a local attacker with OS kernel privileges to write to arbitrary physical memory. The vulnerability is exploitable because the vulnerable code runs in the highly privileged System Management Mode (SMM). Successful exploitation could enable an attacker to modify SMM-protected memory. This modification might lead to arbitrary code execution within SMM. The vulnerability enables reading or writing arbitrary physical memory, including System Management RAM (SMRAM). An attacker can trigger this vulnerability by issuing a Software SMI via I/O port 0xB2 with crafted CPU register values. The affected handler fails to validate parameters, allowing manipulation of memory addresses and data. Consequently, an attacker could achieve persistence by modifying SMRAM and potentially altering SMM execution. Users should consult HP's security bulletins to identify if their system is affected.