CVE-2026-54333

Received Received - Intake

Heap Buffer Overflow in UEFI Firmware Parser

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: GitHub, Inc.

Description

UEFI Firmware Parser parses BIOS, Intel ME, and UEFI firmware structures including volumes, file systems, and files. Prior to 1.14, MakeTable() in uefi_firmware/compression/Tiano/Decompress.c does not validate that bit-length values read from a crafted Tiano or EFI compressed firmware bitstream remain within the expected range from 0 through 16. The normal CompressedSection.process() to efi_compressor.TianoDecompress() to TianoDecompress() to ReadPTLen() to MakeTable() parsing path can consequently write beyond the stack-allocated Count[17] array and related decode tables. The resulting stack corruption deterministically crashes the parsing process and may permit code execution depending on build and runtime details. This issue is fixed in version 1.14.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-14

Last Modified

2026-09-14

Generated

2026-09-15

AI Q&A

2026-09-15

EPSS Evaluated

N/A

NVD

CVE-2026-54333

Affected Vendors & Products

Vendor	Product	Version / Range
uefi_firmware_parser	uefi_firmware_parser	to 1.14 (inc)
theopolis	uefi-firmware-parser	to 1.12 (inc)
theopolis	uefi-firmware-parser	1.13
theopolis	uefi-firmware-parser	1.14

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability is a stack out-of-bounds write flaw in the Tiano/EFI decompressor of the uefi-firmware-parser tool. It occurs in the MakeTable() function where bit-length values from compressed firmware bitstreams are not validated to ensure they stay within the expected range of 0 to 16. Crafted firmware blobs can exploit this by providing bit lengths exceeding 16, causing out-of-bounds writes to stack-allocated arrays. This leads to crashes or potential code execution depending on runtime conditions.

Detection Guidance

This vulnerability affects the uefi-firmware-parser tool itself, not network or system detection. To check if your system uses a vulnerable version, run: pip show uefi-firmware-parser. If the version is <=1.12, it is vulnerable. For firmware analysis, use the tool's decompressor functions on firmware files to observe crashes or errors.

Impact Analysis

The vulnerability can cause the parsing process to crash deterministically. In some cases, it may allow code execution within the context of the parsing process, potentially leading to unauthorized access or control. Since the vulnerability requires no privileges or user interaction and can be exploited remotely, it poses a high risk to systems parsing untrusted firmware.

Mitigation Strategies

Upgrade the uefi-firmware-parser package to version 1.14 or later using: pip install --upgrade uefi-firmware-parser. If you cannot upgrade, avoid parsing untrusted firmware files with the tool. Monitor vendor advisories for firmware updates that may include patched decompressors.

Hi! I’m here to help you understand CVE-2026-54333. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70