CVE-2026-54333

CriticalCVSS 9.8

Published: 14/09/2026(UTC)Translated: 15/09/2026(UTC)NVD NIST

Summary

UEFI Firmware Parser prior to 1.14 has a flaw in MakeTable() in uefi_firmware/compression/Tiano/Decompress.c that does not validate that bit-length values read from a crafted Tiano or EFI compressed firmware bitstream remain within the expected range from 0 through 16. The parsing path CompressedSection.process() to efi_compressor.TianoDecompress() to TianoDecompress() to ReadPTLen() to MakeTable() can write beyond the stack-allocated Count[17] array and related decode tables. The resulting stack corruption deterministically crashes the parsing process and may permit code execution. This issue is fixed in version 1.14.

Risk Assessment

An attacker can supply crafted firmware that corrupts the stack and potentially executes code, leading to compromise of the parsing process.

Recommendation

Update UEFI Firmware Parser to version 1.14 or later and avoid parsing untrusted firmware images.

Other vulnerabilities in UEFI Firmware Parser

CVE-2026-54334Critical
UEFI Firmware Parser prior to 1.14 has a flaw in ReadCLen() in uefi_firmware/compression/Tiano/Decompress.c where reading Number from GetBits(Sd, CBIT) with CBIT = 9 can obtain 511 entries for the 510-element Sd->mCLen heap array because its loop does not enforce Index < NC. The CharC == 2 run-length path can additionally request up to 531 zero writes through Sd->mCLen[Index++] = 0. Crafted Tiano or EFI compressed firmware can corrupt heap memory, deterministically crash the parsing process, and potentially execute code. This issue is fixed in version 1.14.

Original NVD description (English source)

UEFI Firmware Parser parses BIOS, Intel ME, and UEFI firmware structures including volumes, file systems, and files. Prior to 1.14, MakeTable() in uefi_firmware/compression/Tiano/Decompress.c does not validate that bit-length values read from a crafted Tiano or EFI compressed firmware bitstream remain within the expected range from 0 through 16. The normal CompressedSection.process() to efi_compressor.TianoDecompress() to TianoDecompress() to ReadPTLen() to MakeTable() parsing path can consequently write beyond the stack-allocated Count[17] array and related decode tables. The resulting stack corruption deterministically crashes the parsing process and may permit code execution depending on build and runtime details. This issue is fixed in version 1.14.