CVE-2026-54333: CWE-787: Out-of-bounds Write in theopolis uefi-firmware-parser
UEFI Firmware Parser parses BIOS, Intel ME, and UEFI firmware structures including volumes, file systems, and files. Prior to 1.14, MakeTable() in uefi_firmware/compression/Tiano/Decompress.c does not validate that bit-length values read from a crafted Tiano or EFI compressed firmware bitstream remain within the expected range from 0 through 16. The normal CompressedSection.process() to efi_compressor.TianoDecompress() to TianoDecompress() to ReadPTLen() to MakeTable() parsing path can consequently write beyond the stack-allocated Count[17] array and related decode tables. The resulting stack corruption deterministically crashes the parsing process and may permit code execution depending on build and runtime details. This issue is fixed in version 1.14.
AI Analysis
Technical Summary
Theopolis uefi-firmware-parser versions before 1.14 contain a stack-based buffer overflow vulnerability (CWE-787) in the MakeTable() function within the Tiano decompression code. Specifically, bit-length values read from crafted compressed firmware bitstreams are not validated to remain within the expected 0 to 16 range. This leads to out-of-bounds writes beyond the Count[17] array and related decode tables on the stack. The flaw can cause a deterministic crash of the parsing process and potentially allow arbitrary code execution depending on the environment. The vulnerability is addressed by proper validation in version 1.14.
Potential Impact
Successful exploitation of this vulnerability can cause a crash of the firmware parsing process and may allow remote or local attackers to execute arbitrary code with the privileges of the parsing process. The CVSS 3.1 base score is 9.8 (critical), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.
Mitigation Recommendations
Upgrade to version 1.14 or later of theopolis uefi-firmware-parser, where this vulnerability is fixed by validating bit-length values in the MakeTable() function. No other mitigations are specified. Patch status is confirmed fixed in 1.14.
CVE-2026-54333: CWE-787: Out-of-bounds Write in theopolis uefi-firmware-parser
Description
UEFI Firmware Parser parses BIOS, Intel ME, and UEFI firmware structures including volumes, file systems, and files. Prior to 1.14, MakeTable() in uefi_firmware/compression/Tiano/Decompress.c does not validate that bit-length values read from a crafted Tiano or EFI compressed firmware bitstream remain within the expected range from 0 through 16. The normal CompressedSection.process() to efi_compressor.TianoDecompress() to TianoDecompress() to ReadPTLen() to MakeTable() parsing path can consequently write beyond the stack-allocated Count[17] array and related decode tables. The resulting stack corruption deterministically crashes the parsing process and may permit code execution depending on build and runtime details. This issue is fixed in version 1.14.
CVSS v3.1
Score 9.8critical
Affected software
theopolis
uefi-firmware-parser
pkg:github/theopolis/uefi-firmware-parserRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Theopolis uefi-firmware-parser versions before 1.14 contain a stack-based buffer overflow vulnerability (CWE-787) in the MakeTable() function within the Tiano decompression code. Specifically, bit-length values read from crafted compressed firmware bitstreams are not validated to remain within the expected 0 to 16 range. This leads to out-of-bounds writes beyond the Count[17] array and related decode tables on the stack. The flaw can cause a deterministic crash of the parsing process and potentially allow arbitrary code execution depending on the environment. The vulnerability is addressed by proper validation in version 1.14.
Potential Impact
Successful exploitation of this vulnerability can cause a crash of the firmware parsing process and may allow remote or local attackers to execute arbitrary code with the privileges of the parsing process. The CVSS 3.1 base score is 9.8 (critical), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.
Mitigation Recommendations
Upgrade to version 1.14 or later of theopolis uefi-firmware-parser, where this vulnerability is fixed by validating bit-length values in the MakeTable() function. No other mitigations are specified. Patch status is confirmed fixed in 1.14.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-12T19:23:22.316Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6aa8567155bf5e2cf58d7f02
Added to database: 09/14/2026, 20:17:53 UTC
Last enriched: 09/14/2026, 20:31:53 UTC
Last updated: 09/15/2026, 03:22:13 UTC
Views: 9
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.