CVE-2026-54334

UEFI Firmware Parser (uefi-firmware-parser) before version 1.14 contains a heap out-of-bounds write (CWE-787) in the Tiano/EFI decompression path: ReadCLen() in uefi_firmware/compression/Tiano/Decompress.c reads a 9-bit count (up to 511 entries) into the 510-element mCLen heap array without enforcing the bound, corrupting adjacent heap memory. The flaw is triggered when the parser processes a crafted Tiano- or EFI-compressed section via the standard CompressedSection.process() -> efi_compressor.TianoDecompress() -> DecodeC() -> ReadCLen() route, so any workflow that parses untrusted firmware images is exposed. Impact is a deterministic crash of the parsing process and, depending on build and runtime heap layout, potential remote code execution — reflected in the critical 9.8 CVSS score (network vector, no privileges or user interaction required, high C/I/A impact), which is most relevant for services that accept firmware uploads. Affected users are developers, firmware analysts, and automated firmware-analysis pipelines or web services still running versions prior to 1.14. The issue is fixed in version 1.14; no public proof of concept exists, it is not in the CISA KEV catalog, and no exploitation is known.

What to do: Upgrade to uefi-firmware-parser 1.14 or later immediately (e.g., pip install --upgrade uefi-firmware-parser) and verify with 'pip show uefi-firmware-parser'. If you operate a service or pipeline that parses user-supplied or otherwise untrusted firmware images, ensure it uses the fixed version and run the parser in an isolated container/sandbox to limit the blast radius of malformed compressed sections. Audit logs for crashes or anomalies in parsing jobs that handled Tiano- or EFI-compressed firmware as a precaution.