CVE-2026-54334
Received Received - Intake

UEFI Firmware Parser Heap Corruption Vulnerability

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: GitHub, Inc.

Description
UEFI Firmware Parser parses BIOS, Intel ME, and UEFI firmware structures including volumes, file systems, and files. Prior to 1.14, ReadCLen() in uefi_firmware/compression/Tiano/Decompress.c reads Number from GetBits(Sd, CBIT) with CBIT = 9 and can obtain 511 entries for the 510-element Sd->mCLen heap array because its loop does not enforce Index < NC. The CharC == 2 run-length path can additionally request up to 531 zero writes through Sd->mCLen[Index++] = 0. The normal CompressedSection.process() to efi_compressor.TianoDecompress() to TianoDecompress() to DecodeC() to ReadCLen() parsing path therefore permits crafted Tiano or EFI compressed firmware to corrupt heap memory, deterministically crash the parsing process, and potentially execute code depending on build and runtime details. This issue is fixed in version 1.14.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-15
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-54334

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
theopolis uefi_firmware_parser to 1.12 (inc)
theopolis uefi_firmware_parser 1.13
theopolis uefi_firmware_parser 1.14

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a heap out-of-bounds write vulnerability in the Tiano decompressor's ReadCLen function in the uefi-firmware-parser project. The function reads a Number value with CBIT=9, allowing it to reach 511, but the destination array only has 510 elements. The loop writes to the array without checking bounds, causing heap corruption. A run-length path can also write up to 531 zeros. This can crash the parser or potentially allow code execution depending on runtime conditions.

Detection Guidance

To detect this vulnerability, check the version of the uefi-firmware-parser package installed on your system. Use the command 'pip show uefi-firmware-parser' to verify if the version is below 1.13. If it is, the system is vulnerable.

Impact Analysis

The vulnerability can cause the parsing process to crash deterministically. In some cases, it may allow arbitrary code execution within the context of the parser, potentially compromising the system running the uefi-firmware-parser tool. No privileges or user interaction are required for exploitation, and it can be triggered remotely.

Compliance Impact

This vulnerability could lead to arbitrary code execution due to heap corruption, potentially compromising the integrity and confidentiality of firmware parsing operations. For GDPR, this may result in unauthorized access to personal data processed by systems relying on vulnerable firmware parsers. For HIPAA, it could expose protected health information if exploited in medical devices or systems handling such data.

Mitigation Strategies

Update the uefi-firmware-parser package to version 1.13 or later to address the heap out-of-bounds write issue in the Tiano decompressor. If using the pip package, run 'pip install --upgrade uefi-firmware-parser>=1.13'.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-54334. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart