Vulnerability-Lookup

CVE-2026-54334 (GCVE-0-2026-54334)

Vulnerability from cvelistv5 – Published: 2026-09-14 20:06 – Updated: 2026-09-16 18:35

Title

UEFI Firmware Parser: Heap out-of-bounds write in tiano decompressor `ReadCLen`

Summary

UEFI Firmware Parser parses BIOS, Intel ME, and UEFI firmware structures including volumes, file systems, and files. Prior to 1.14, ReadCLen() in uefi_firmware/compression/Tiano/Decompress.c reads Number from GetBits(Sd, CBIT) with CBIT = 9 and can obtain 511 entries for the 510-element Sd->mCLen heap array because its loop does not enforce Index < NC. The CharC == 2 run-length path can additionally request up to 531 zero writes through Sd->mCLen[Index++] = 0. The normal CompressedSection.process() to efi_compressor.TianoDecompress() to TianoDecompress() to DecodeC() to ReadCLen() parsing path therefore permits crafted Tiano or EFI compressed firmware to corrupt heap memory, deterministically crash the parsing process, and potentially execute code depending on build and runtime details. This issue is fixed in version 1.14.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-16 18:35 UTC

CWE

CWE-787 - Out-of-bounds Write

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/theopolis/uefi-firmware-parser…	x_refsource_CONFIRM
https://github.com/theopolis/uefi-firmware-parser…	x_refsource_MISC
https://github.com/theopolis/uefi-firmware-parser…	x_refsource_MISC
https://github.com/theopolis/uefi-firmware-parser…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
theopolis	uefi-firmware-parser	Affected: < 1.14	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54334",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-16T18:35:51.342560Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-16T18:35:59.871Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "uefi-firmware-parser",
          "vendor": "theopolis",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.14"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "UEFI Firmware Parser parses BIOS, Intel ME, and UEFI firmware structures including volumes, file systems, and files. Prior to 1.14, ReadCLen() in uefi_firmware/compression/Tiano/Decompress.c reads Number from GetBits(Sd, CBIT) with CBIT = 9 and can obtain 511 entries for the 510-element Sd-\u003emCLen heap array because its loop does not enforce Index \u003c NC. The CharC == 2 run-length path can additionally request up to 531 zero writes through Sd-\u003emCLen[Index++] = 0. The normal CompressedSection.process() to efi_compressor.TianoDecompress() to TianoDecompress() to DecodeC() to ReadCLen() parsing path therefore permits crafted Tiano or EFI compressed firmware to corrupt heap memory, deterministically crash the parsing process, and potentially execute code depending on build and runtime details. This issue is fixed in version 1.14."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "CWE-787: Out-of-bounds Write",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T20:06:42.388Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/theopolis/uefi-firmware-parser/security/advisories/GHSA-hm2w-vr2p-hq7w",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/theopolis/uefi-firmware-parser/security/advisories/GHSA-hm2w-vr2p-hq7w"
        },
        {
          "name": "https://github.com/theopolis/uefi-firmware-parser/pull/145",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/theopolis/uefi-firmware-parser/pull/145"
        },
        {
          "name": "https://github.com/theopolis/uefi-firmware-parser/commit/bf3dfaa8a05675bae6ea0cbfa082ddcebfcde23e",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/theopolis/uefi-firmware-parser/commit/bf3dfaa8a05675bae6ea0cbfa082ddcebfcde23e"
        },
        {
          "name": "https://github.com/theopolis/uefi-firmware-parser/releases/tag/v1.14",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/theopolis/uefi-firmware-parser/releases/tag/v1.14"
        }
      ],
      "source": {
        "advisory": "GHSA-hm2w-vr2p-hq7w",
        "discovery": "UNKNOWN"
      },
      "title": "UEFI Firmware Parser: Heap out-of-bounds write in tiano decompressor `ReadCLen`"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54334",
    "datePublished": "2026-09-14T20:06:42.388Z",
    "dateReserved": "2026-06-12T19:23:22.316Z",
    "dateUpdated": "2026-09-16T18:35:59.871Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-54334",
      "date": "2026-09-19",
      "epss": "0.00434",
      "percentile": "0.37182"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "uefi-firmware-parser",
                "vendor": "theopolis",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 1.14"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "UEFI Firmware Parser parses BIOS, Intel ME, and UEFI firmware structures including volumes, file systems, and files. Prior to 1.14, ReadCLen() in uefi_firmware/compression/Tiano/Decompress.c reads Number from GetBits(Sd, CBIT) with CBIT = 9 and can obtain 511 entries for the 510-element Sd-\u003emCLen heap array because its loop does not enforce Index \u003c NC. The CharC == 2 run-length path can additionally request up to 531 zero writes through Sd-\u003emCLen[Index++] = 0. The normal CompressedSection.process() to efi_compressor.TianoDecompress() to TianoDecompress() to DecodeC() to ReadCLen() parsing path therefore permits crafted Tiano or EFI compressed firmware to corrupt heap memory, deterministically crash the parsing process, and potentially execute code depending on build and runtime details. This issue is fixed in version 1.14."
          }
        ],
        "id": "CVE-2026-54334",
        "lastModified": "2026-09-16T19:17:19.577",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-54334",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-16T18:35:51.342560Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-09-14T20:16:46.143",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/theopolis/uefi-firmware-parser/commit/bf3dfaa8a05675bae6ea0cbfa082ddcebfcde23e"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/theopolis/uefi-firmware-parser/pull/145"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/theopolis/uefi-firmware-parser/releases/tag/v1.14"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/theopolis/uefi-firmware-parser/security/advisories/GHSA-hm2w-vr2p-hq7w"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Received",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-787"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-54334",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-09-16T18:35:51.342560Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-09-16T18:35:56.481Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "uefi-firmware-parser",
              "vendor": "theopolis",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 1.14"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "UEFI Firmware Parser parses BIOS, Intel ME, and UEFI firmware structures including volumes, file systems, and files. Prior to 1.14, ReadCLen() in uefi_firmware/compression/Tiano/Decompress.c reads Number from GetBits(Sd, CBIT) with CBIT = 9 and can obtain 511 entries for the 510-element Sd-\u003emCLen heap array because its loop does not enforce Index \u003c NC. The CharC == 2 run-length path can additionally request up to 531 zero writes through Sd-\u003emCLen[Index++] = 0. The normal CompressedSection.process() to efi_compressor.TianoDecompress() to TianoDecompress() to DecodeC() to ReadCLen() parsing path therefore permits crafted Tiano or EFI compressed firmware to corrupt heap memory, deterministically crash the parsing process, and potentially execute code depending on build and runtime details. This issue is fixed in version 1.14."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-787",
                  "description": "CWE-787: Out-of-bounds Write",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-14T20:06:42.388Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/theopolis/uefi-firmware-parser/security/advisories/GHSA-hm2w-vr2p-hq7w",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/theopolis/uefi-firmware-parser/security/advisories/GHSA-hm2w-vr2p-hq7w"
            },
            {
              "name": "https://github.com/theopolis/uefi-firmware-parser/pull/145",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/theopolis/uefi-firmware-parser/pull/145"
            },
            {
              "name": "https://github.com/theopolis/uefi-firmware-parser/commit/bf3dfaa8a05675bae6ea0cbfa082ddcebfcde23e",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/theopolis/uefi-firmware-parser/commit/bf3dfaa8a05675bae6ea0cbfa082ddcebfcde23e"
            },
            {
              "name": "https://github.com/theopolis/uefi-firmware-parser/releases/tag/v1.14",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/theopolis/uefi-firmware-parser/releases/tag/v1.14"
            }
          ],
          "source": {
            "advisory": "GHSA-hm2w-vr2p-hq7w",
            "discovery": "UNKNOWN"
          },
          "title": "UEFI Firmware Parser: Heap out-of-bounds write in tiano decompressor `ReadCLen`"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-54334",
        "datePublished": "2026-09-14T20:06:42.388Z",
        "dateReserved": "2026-06-12T19:23:22.316Z",
        "dateUpdated": "2026-09-16T18:35:59.871Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-54334

Vulnerability from fkie_nvd - Published: 2026-09-14 20:16 - Updated: 2026-09-16 19:17

Severity

9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/theopolis/uefi-firmware-parser/commit/bf3dfaa8a05675bae6ea0cbfa082ddcebfcde23e
	security-advisories@github.com	https://github.com/theopolis/uefi-firmware-parser/pull/145
	security-advisories@github.com	https://github.com/theopolis/uefi-firmware-parser/releases/tag/v1.14
	security-advisories@github.com	https://github.com/theopolis/uefi-firmware-parser/security/advisories/GHSA-hm2w-vr2p-hq7w

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "uefi-firmware-parser",
          "vendor": "theopolis",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.14"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "UEFI Firmware Parser parses BIOS, Intel ME, and UEFI firmware structures including volumes, file systems, and files. Prior to 1.14, ReadCLen() in uefi_firmware/compression/Tiano/Decompress.c reads Number from GetBits(Sd, CBIT) with CBIT = 9 and can obtain 511 entries for the 510-element Sd-\u003emCLen heap array because its loop does not enforce Index \u003c NC. The CharC == 2 run-length path can additionally request up to 531 zero writes through Sd-\u003emCLen[Index++] = 0. The normal CompressedSection.process() to efi_compressor.TianoDecompress() to TianoDecompress() to DecodeC() to ReadCLen() parsing path therefore permits crafted Tiano or EFI compressed firmware to corrupt heap memory, deterministically crash the parsing process, and potentially execute code depending on build and runtime details. This issue is fixed in version 1.14."
    }
  ],
  "id": "CVE-2026-54334",
  "lastModified": "2026-09-16T19:17:19.577",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-54334",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-16T18:35:51.342560Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-14T20:16:46.143",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/theopolis/uefi-firmware-parser/commit/bf3dfaa8a05675bae6ea0cbfa082ddcebfcde23e"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/theopolis/uefi-firmware-parser/pull/145"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/theopolis/uefi-firmware-parser/releases/tag/v1.14"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/theopolis/uefi-firmware-parser/security/advisories/GHSA-hm2w-vr2p-hq7w"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-HM2W-VR2P-HQ7W

Vulnerability from github – Published: 2026-04-16 01:31 – Updated: 2026-07-08 17:32

Summary

UEFI Firmware Parser has a heap out-of-bounds write in tiano decompressor ReadCLen

Details

uefi-firmware contains a heap out-of-bounds write vulnerability in the native tiano/EFI decompressor. in uefi_firmware/compression/Tiano/Decompress.c, ReadCLen() reads Number = GetBits(Sd, CBIT) with CBIT = 9, so Number can be as large as 511, while the destination array Sd->mCLen has NC = 510 elements. the loop writes while Index < Number without enforcing Index < NC. additionally, the CharC == 2 run-length path performs GetBits(Sd, 9) + 20, allowing up to 531 zero writes through Sd->mCLen[Index++] = 0.

Reachability is through the normal parsing path: CompressedSection.process() -> efi_compressor.TianoDecompress() -> TianoDecompress() -> DecodeC() -> ReadCLen().

Minimum impact is a deterministic crash; depending on build/runtime details, the heap memory corruption may be exploitable for code execution in the context of the parsing process. this project shipped its own copy of the decompressor without the upstream EDK2 hardening for this bug class.

PR: https://github.com/theopolis/uefi-firmware-parser/pull/145
fix commit: https://github.com/theopolis/uefi-firmware-parser/commit/bf3dfaa8a05675bae6ea0cbfa082ddcebfcde23e
upstream related fixes: CVE-2017-5731, CVE-2017-5732, CVE-2017-5733, CVE-2017-5734, CVE-2017-5735

Severity

9.8 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "uefi-firmware"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "1.12"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54334"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-787"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-16T01:31:09Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
  },
  "details": "`uefi-firmware` contains a heap out-of-bounds write vulnerability in the native tiano/EFI decompressor. in `uefi_firmware/compression/Tiano/Decompress.c`, `ReadCLen()` reads `Number = GetBits(Sd, CBIT)` with `CBIT = 9`, so `Number` can be as large as `511`, while the destination array `Sd-\u003emCLen` has `NC = 510` elements. the loop writes while `Index \u003c Number` without enforcing `Index \u003c NC`. additionally, the `CharC == 2` run-length path performs `GetBits(Sd, 9) + 20`, allowing up to `531` zero writes through `Sd-\u003emCLen[Index++] = 0`.\n\nReachability is through the normal parsing path: `CompressedSection.process()` -\u003e `efi_compressor.TianoDecompress()` -\u003e `TianoDecompress()` -\u003e `DecodeC()` -\u003e `ReadCLen()`.\n\nMinimum impact is a deterministic crash; depending on build/runtime details, the heap memory corruption may be exploitable for code execution in the context of the parsing process. this project shipped its own copy of the decompressor without the upstream EDK2 hardening for this bug class.\n\n- PR: \u003chttps://github.com/theopolis/uefi-firmware-parser/pull/145\u003e\n- fix commit: \u003chttps://github.com/theopolis/uefi-firmware-parser/commit/bf3dfaa8a05675bae6ea0cbfa082ddcebfcde23e\u003e\n- upstream related fixes: CVE-2017-5731, CVE-2017-5732, CVE-2017-5733, CVE-2017-5734, CVE-2017-5735",
  "id": "GHSA-hm2w-vr2p-hq7w",
  "modified": "2026-07-08T17:32:55Z",
  "published": "2026-04-16T01:31:09Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/theopolis/uefi-firmware-parser/security/advisories/GHSA-hm2w-vr2p-hq7w"
    },
    {
      "type": "WEB",
      "url": "https://github.com/theopolis/uefi-firmware-parser/pull/145"
    },
    {
      "type": "WEB",
      "url": "https://github.com/theopolis/uefi-firmware-parser/commit/bf3dfaa8a05675bae6ea0cbfa082ddcebfcde23e"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/theopolis/uefi-firmware-parser"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "UEFI Firmware Parser has a heap out-of-bounds write in tiano decompressor ReadCLen"
}

PYSEC-2026-3394

Vulnerability from pysec - Published: 2026-07-13 15:02 - Updated: 2026-07-13 16:07

Details

Reachability is through the normal parsing path: CompressedSection.process() -> efi_compressor.TianoDecompress() -> TianoDecompress() -> DecodeC() -> ReadCLen().

PR: https://github.com/theopolis/uefi-firmware-parser/pull/145
fix commit: https://github.com/theopolis/uefi-firmware-parser/commit/bf3dfaa8a05675bae6ea0cbfa082ddcebfcde23e
upstream related fixes: CVE-2017-5731, CVE-2017-5732, CVE-2017-5733, CVE-2017-5734, CVE-2017-5735

Severity

9.8 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Impacted products

Name	purl
uefi-firmware	pkg:pypi/uefi-firmware

Aliases

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "uefi-firmware",
        "purl": "pkg:pypi/uefi-firmware"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "1.12"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.1",
        "1.10",
        "1.11",
        "1.2",
        "1.3",
        "1.4",
        "1.6",
        "1.7",
        "1.8",
        "1.9"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54334",
    "GHSA-hm2w-vr2p-hq7w"
  ],
  "details": "`uefi-firmware` contains a heap out-of-bounds write vulnerability in the native tiano/EFI decompressor. in `uefi_firmware/compression/Tiano/Decompress.c`, `ReadCLen()` reads `Number = GetBits(Sd, CBIT)` with `CBIT = 9`, so `Number` can be as large as `511`, while the destination array `Sd-\u003emCLen` has `NC = 510` elements. the loop writes while `Index \u003c Number` without enforcing `Index \u003c NC`. additionally, the `CharC == 2` run-length path performs `GetBits(Sd, 9) + 20`, allowing up to `531` zero writes through `Sd-\u003emCLen[Index++] = 0`.\n\nReachability is through the normal parsing path: `CompressedSection.process()` -\u003e `efi_compressor.TianoDecompress()` -\u003e `TianoDecompress()` -\u003e `DecodeC()` -\u003e `ReadCLen()`.\n\nMinimum impact is a deterministic crash; depending on build/runtime details, the heap memory corruption may be exploitable for code execution in the context of the parsing process. this project shipped its own copy of the decompressor without the upstream EDK2 hardening for this bug class.\n\n- PR: \u003chttps://github.com/theopolis/uefi-firmware-parser/pull/145\u003e\n- fix commit: \u003chttps://github.com/theopolis/uefi-firmware-parser/commit/bf3dfaa8a05675bae6ea0cbfa082ddcebfcde23e\u003e\n- upstream related fixes: CVE-2017-5731, CVE-2017-5732, CVE-2017-5733, CVE-2017-5734, CVE-2017-5735",
  "id": "PYSEC-2026-3394",
  "modified": "2026-07-13T16:07:22.442182Z",
  "published": "2026-07-13T15:02:48.573733Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/theopolis/uefi-firmware-parser/security/advisories/GHSA-hm2w-vr2p-hq7w"
    },
    {
      "type": "WEB",
      "url": "https://github.com/theopolis/uefi-firmware-parser/pull/145"
    },
    {
      "type": "WEB",
      "url": "https://github.com/theopolis/uefi-firmware-parser/commit/bf3dfaa8a05675bae6ea0cbfa082ddcebfcde23e"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/theopolis/uefi-firmware-parser"
    },
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/uefi-firmware"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-hm2w-vr2p-hq7w"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54334"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "UEFI Firmware Parser has a heap out-of-bounds write in tiano decompressor ReadCLen"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-54334 (GCVE-0-2026-54334)

FKIE_CVE-2026-54334

GHSA-HM2W-VR2P-HQ7W

PYSEC-2026-3394

Tags

Sightings

Nomenclature

Related by attack behaviour