CVE-2026-54333

UEFI Firmware Parser versions before 1.14 contain an out-of-bounds stack write in MakeTable() within the Tiano/EFI decompression code: bit-length values read from a compressed firmware bitstream are not validated against the expected 0-16 range, so writes run past the stack-allocated Count[17] array and related decode tables. The flaw is triggered simply by parsing a crafted Tiano- or EFI-compressed firmware section through the normal CompressedSection.process() to efi_compressor.TianoDecompress() to ReadPTlen()/MakeTable() path, requiring no privileges or interaction beyond opening the malicious image. The resulting stack corruption deterministically crashes the parsing process and may permit code execution depending on build and runtime details, reflected in a critical 9.8 CVSS score. Anyone using the uefi_firmware package or CLI below 1.14 — including firmware-analysis pipelines and services that ingest untrusted BIOS or UEFI images — is affected. The issue is fixed in version 1.14; there is no known public PoC, it is not in CISA's KEV, and no exploitation in the wild has been reported.

What to do: Upgrade to UEFI Firmware Parser 1.14 or later, which validates the bit-length values before building decode tables. Until upgraded, only parse untrusted or third-party firmware dumps in sandboxed VMs or containers with minimal privileges, and treat crashes while decompressing Tiano/EFI sections as potential exploitation. Audit any automated pipelines (CI, malware triage, BIOS-upload analysis services) that feed external firmware images into the parser and ensure they run the fixed version.