A LogoFAIL issue was discovered in BmpDecoderDxe in Insyde InsydeH2O with kernel 5.2 before 05.28.47, 5.3 before 05.37.47, 5.4 before 05.45…

published 2023-12-07 2 y ago modified 2026-06-17 4 mo ago also EUVD-2023-44835

cvss: 5.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 1.8%; EPSS 1.8% chance of exploitation in 30 days, percentile 79%
public exploits: 0; none known

A LogoFAIL issue was discovered in BmpDecoderDxe in Insyde InsydeH2O with kernel 5.2 before 05.28.47, 5.3 before 05.37.47, 5.4 before 05.45.47, 5.5 before 05.53.47, and 5.6 before 05.60.47 for certain Lenovo devices. Image parsing of crafted BMP logo files can copy data to a specific address during the DXE phase of UEFI execution. This occurs because of an integer signedness error involving PixelHeight and PixelWidth during RLE4/RLE8 compression.

Patch / fix

fixed in 20

insyde insydeh2o 5.2.05.28.47, 5.3.05.37.47, 5.4.05.45.47, 5.5.05.53.47, 5.6.05.60.47
fujitsu esprimo_d556/2_firmware 1.35.0
fujitsu esprimo_d6011_firmware 1.31.0
fujitsu esprimo_d6012_firmware 3.08.0
fujitsu esprimo_d7010_firmware 1.64.0
fujitsu esprimo_d7010/8_firmware 1.64.0
fujitsu esprimo_d7011_firmware 1.31.0
fujitsu esprimo_d7012_firmware 3.08.0
fujitsu esprimo_d7013_firmware 3.08.0
fujitsu esprimo_d738_firmware 1.38.0
fujitsu esprimo_d757_firmware 1.35.0
fujitsu esprimo_d9010_firmware 1.64.0
fujitsu esprimo_d9011_firmware 1.31.0
fujitsu esprimo_d9012_firmware 3.08.0
fujitsu esprimo_d9013_firmware 3.08.0
fujitsu esprimo_d957_firmware 1.35.0
fujitsu esprimo_d957/e9x+_firmware 1.35.0
fujitsu esprimo_d958_firmware 1.38.0
fujitsu esprimo_g5010_firmware 1.45.0
fujitsu esprimo_g5011_firmware 1.27.0

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 2 y ago (2023-12-08)

Exploit prediction

1.84% chance of exploitation in the next 30 days, higher than 79% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

binarly.io https://binarly.io/posts/finding_logofail_the_dangers_of_image_parsing_during_system_boot/index.html referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	5.5	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
NVD	3.1	5.5	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA	3.1	5.5	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Classification

Weakness

CWE-312 Cleartext Storage of Sensitive Information

References

binarly.io /posts/finding_logofail_the_dangers_of_image_parsing_during_system_boot/index.html
exploit
insyde.com /security-pledge
vendor-advisory
insyde.com /security-pledge/SA-2023053
vendor-advisory
kb.cert.org /vuls/id/811862
third-party-advisory
security.netapp.com /advisory/ntap-20240105-0002/
third-party-advisory

Sources

CVE List CVE-2023-40238
NVD CVE-2023-40238

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary