CVE-2026-54334

CriticalCVSS 9.8

Published: 14/09/2026(UTC)Translated: 15/09/2026(UTC)NVD NIST

Summary

UEFI Firmware Parser prior to 1.14 has a flaw in ReadCLen() in uefi_firmware/compression/Tiano/Decompress.c where reading Number from GetBits(Sd, CBIT) with CBIT = 9 can obtain 511 entries for the 510-element Sd->mCLen heap array because its loop does not enforce Index < NC. The CharC == 2 run-length path can additionally request up to 531 zero writes through Sd->mCLen[Index++] = 0. Crafted Tiano or EFI compressed firmware can corrupt heap memory, deterministically crash the parsing process, and potentially execute code. This issue is fixed in version 1.14.

Risk Assessment

An attacker can supply malicious firmware that corrupts memory and potentially executes code, leading to compromise of the parsing process.

Recommendation

Update UEFI Firmware Parser to version 1.14 or later and avoid parsing untrusted firmware images.

Other vulnerabilities in UEFI Firmware Parser

CVE-2026-54333Critical
UEFI Firmware Parser prior to 1.14 has a flaw in MakeTable() in uefi_firmware/compression/Tiano/Decompress.c that does not validate that bit-length values read from a crafted Tiano or EFI compressed firmware bitstream remain within the expected range from 0 through 16. The parsing path CompressedSection.process() to efi_compressor.TianoDecompress() to TianoDecompress() to ReadPTLen() to MakeTable() can write beyond the stack-allocated Count[17] array and related decode tables. The resulting stack corruption deterministically crashes the parsing process and may permit code execution. This issue is fixed in version 1.14.

Original NVD description (English source)

UEFI Firmware Parser parses BIOS, Intel ME, and UEFI firmware structures including volumes, file systems, and files. Prior to 1.14, ReadCLen() in uefi_firmware/compression/Tiano/Decompress.c reads Number from GetBits(Sd, CBIT) with CBIT = 9 and can obtain 511 entries for the 510-element Sd->mCLen heap array because its loop does not enforce Index < NC. The CharC == 2 run-length path can additionally request up to 531 zero writes through Sd->mCLen[Index++] = 0. The normal CompressedSection.process() to efi_compressor.TianoDecompress() to TianoDecompress() to DecodeC() to ReadCLen() parsing path therefore permits crafted Tiano or EFI compressed firmware to corrupt heap memory, deterministically crash the parsing process, and potentially execute code depending on build and runtime details. This issue is fixed in version 1.14.