theopolis uefi-firmware-parser up to 1.13 Tiano Decompression Decompress.c ReadCLen Index heap-based overflow

Summaryinfo

A vulnerability, which was classified as very critical, has been found in theopolis uefi-firmware-parser up to 1.13. This affects the function ReadCLen of the file uefi_firmware/compression/Tiano/Decompress.c of the component Tiano Decompression. Performing a manipulation of the argument Index results in heap-based overflow. This vulnerability is cataloged as CVE-2026-54334. It is possible to initiate the attack remotely. There is no exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in theopolis uefi-firmware-parser up to 1.13. It has been classified as very critical. This affects the function ReadCLen of the file uefi_firmware/compression/Tiano/Decompress.c of the component Tiano Decompression. The manipulation of the argument Index with an unknown input leads to a heap-based overflow vulnerability. CWE is classifying the issue as CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

UEFI Firmware Parser parses BIOS, Intel ME, and UEFI firmware structures including volumes, file systems, and files. Prior to 1.14, ReadCLen() in uefi_firmware/compression/Tiano/Decompress.c reads Number from GetBits(Sd, CBIT) with CBIT = 9 and can obtain 511 entries for the 510-element Sd->mCLen heap array because its loop does not enforce Index < NC. The CharC == 2 run-length path can additionally request up to 531 zero writes through Sd->mCLen[Index++] = 0. The normal CompressedSection.process() to efi_compressor.TianoDecompress() to TianoDecompress() to DecodeC() to ReadCLen() parsing path therefore permits crafted Tiano or EFI compressed firmware to corrupt heap memory, deterministically crash the parsing process, and potentially execute code depending on build and runtime details. This issue is fixed in version 1.14.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-54334 since 06/12/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 09/14/2026).

Upgrading to version 1.14 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Firmware Software

Vendor

• theopolis

Name

• uefi-firmware-parser

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12
• 1.13

Website

• Product: https://github.com/theopolis/uefi-firmware-parser/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion