CVE-2026-54333

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-54333
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54333.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-54333
Aliases
Published
2026-09-14T20:05:19Z
Modified
2026-09-17T08:07:07Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
UEFI Firmware Parser: Stack out-of-bounds write in tiano decompressor MakeTable
Details

UEFI Firmware Parser parses BIOS, Intel ME, and UEFI firmware structures including volumes, file systems, and files. Prior to 1.14, MakeTable() in uefi_firmware/compression/Tiano/Decompress.c does not validate that bit-length values read from a crafted Tiano or EFI compressed firmware bitstream remain within the expected range from 0 through 16. The normal CompressedSection.process() to efi_compressor.TianoDecompress() to TianoDecompress() to ReadPTLen() to MakeTable() parsing path can consequently write beyond the stack-allocated Count[17] array and related decode tables. The resulting stack corruption deterministically crashes the parsing process and may permit code execution depending on build and runtime details. This issue is fixed in version 1.14.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-787"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54333.json"
}
References

Affected packages

Git / github.com/theopolis/uefi-firmware-parser

Affected ranges

Type
GIT
Repo
https://github.com/theopolis/uefi-firmware-parser
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
bf3dfaa8a05675bae6ea0cbfa082ddcebfcde23e
Fixed
0475f5bfb158a74401cb8c10b75fbf4b4615b664
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.14"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v0.*
v0.2
v0.3
v0.4
v1.*
v1.0
v1.1
v1.10
v1.11
v1.12
v1.13
v1.2
v1.3
v1.4
v1.5
v1.6
v1.8
v1.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54333.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "168915642553637055109770007137980449106",
            "length": 158
        },
        "id": "CVE-2026-54333-1dd3706e",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/theopolis/uefi-firmware-parser/commit/bf3dfaa8a05675bae6ea0cbfa082ddcebfcde23e",
        "target": {
            "file": "uefi_firmware/compression/Tiano/Decompress.c",
            "function": "GetBits"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "231586035991699415140513914683392944416",
            "length": 740
        },
        "id": "CVE-2026-54333-237fcf9e",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/theopolis/uefi-firmware-parser/commit/bf3dfaa8a05675bae6ea0cbfa082ddcebfcde23e",
        "target": {
            "file": "uefi_firmware/compression/Tiano/Decompress.c",
            "function": "Decode"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "295221816256946835991417370092035669004",
            "length": 1179
        },
        "id": "CVE-2026-54333-48a5de99",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/theopolis/uefi-firmware-parser/commit/bf3dfaa8a05675bae6ea0cbfa082ddcebfcde23e",
        "target": {
            "file": "uefi_firmware/compression/Tiano/Decompress.c",
            "function": "ReadCLen"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "236308454089365176463055686737274017035",
            "length": 1136
        },
        "id": "CVE-2026-54333-58840bb4",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/theopolis/uefi-firmware-parser/commit/bf3dfaa8a05675bae6ea0cbfa082ddcebfcde23e",
        "target": {
            "file": "uefi_firmware/compression/Tiano/Decompress.c",
            "function": "Decompress"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "304354982571552241150703015140628071442",
            "length": 521
        },
        "id": "CVE-2026-54333-6bbc74b0",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/theopolis/uefi-firmware-parser/commit/bf3dfaa8a05675bae6ea0cbfa082ddcebfcde23e",
        "target": {
            "file": "uefi_firmware/compression/Tiano/Decompress.c",
            "function": "DecodeP"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "120609890875909521396144982910569885672",
            "length": 618
        },
        "id": "CVE-2026-54333-7978163a",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/theopolis/uefi-firmware-parser/commit/bf3dfaa8a05675bae6ea0cbfa082ddcebfcde23e",
        "target": {
            "file": "uefi_firmware/compression/Tiano/Decompress.c",
            "function": "FillBuf"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "327922903935396794745552192436932201357",
            "length": 776
        },
        "id": "CVE-2026-54333-be94d4f3",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/theopolis/uefi-firmware-parser/commit/bf3dfaa8a05675bae6ea0cbfa082ddcebfcde23e",
        "target": {
            "file": "uefi_firmware/compression/Tiano/Decompress.c",
            "function": "DecodeC"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "123778443143049853070216025773322630235",
            "length": 1741
        },
        "id": "CVE-2026-54333-cba4da29",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/theopolis/uefi-firmware-parser/commit/bf3dfaa8a05675bae6ea0cbfa082ddcebfcde23e",
        "target": {
            "file": "uefi_firmware/compression/Tiano/Decompress.c",
            "function": "MakeTable"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "307426451347538762343545216512842160228",
                "66288153098642525271321119945283865256",
                "76548913602661675534357728792108866178",
                "282447343167205313530532876643709723437",
                "300950909299627676634687633847218747204",
                "43892107581312900241197486217805257031",
                "6545500975843914034601616341977562744",
                "257825656422195845641328285653436027264",
                "2952171528893766223051615397340815507",
                "303570211248613924433784989928780018136",
                "282453620855761066360856317003397386575",
                "168124110974913465547005908794600319036",
                "297415635232805751042281652646928186024",
                "237042347066964586934568369472674973167",
                "310258503744878652528668928688072934546",
                "70713752466510987824694127893737143918",
                "64743642575619694282511583604146307986",
                "113786527940579199407872064235362666313",
                "235299109818653373577257448733762295509",
                "165437673747693382710771502167116955060",
                "199591741621485175847582595992444228314",
                "319943654453009403918259634573886575583",
                "46941706312816900157054286858439084295",
                "84541602497815943992084028965126332680",
                "16847455622719174515123294476296525740",
                "200213660596776669767307213399604649506",
                "91607226550314636789804946846695203192",
                "103966262535189541982718431697659970505",
                "325793465208619326208777317157573036265",
                "323132300614697086509196194743224261765",
                "45705717158140727721996568071553749152",
                "182595905682853098410415664344212981371",
                "336370517005707208275164085299123929675",
                "143663900752738565746415591356472017394",
                "114653703446493081232850292372957229062",
                "55228180925137447548853841081062069203",
                "95089496467827505850004352236521622976",
                "52888867224953026507431235929332959677",
                "61357188310163696116723713001920591021",
                "196144394833499856191417693415536718082",
                "246284847181927529785790189449831599285",
                "14342132865357290621467331781312191828",
                "218249309072904675372184929294730952725",
                "45705717158140727721996568071553749152",
                "14170566339067707731027641152141768378",
                "107875313803737230445463492073394263943",
                "99721832672393874059797316902865130793",
                "118547233183666882408988192777769538176",
                "111377815153245094241456978005591879445",
                "265402046805237174914205136103432571235",
                "142748310322121910908625734691070081760",
                "195857695351971747109941769796142204711",
                "224420571170294979914439959293411956649",
                "109278998348679015136860594132424693681",
                "165900074708433812581926788174318740410",
                "308292806611236488504568074992806671649",
                "96725031613663627557465940103963784772",
                "330218531618179447527472321022675882872",
                "288876893049086862454978489836082033168",
                "274993252410921937334802130311558715560",
                "315076494824132104331955142632684549785",
                "44661990808471457500232751107560176012",
                "123487395793672684721321972079656264815",
                "218772025796675743642843467946530580160",
                "218344874421128252165720898089663083287",
                "321225085073448864499981566313216732514",
                "146159226621925405162324924136501818861",
                "276940672434111124493513576738044410309",
                "82158241590756313041306416203101969225",
                "143709577662559395155071849245623140476",
                "217971553085322599141349791298717544598",
                "30751639405221518372484144391367605425",
                "157105067954470819528234717452150403145",
                "282237489071404505929221706812231158170",
                "297519917884373405223387785464388859474",
                "182372289482748796245313674810860875755",
                "135915489522974077136883858239841517553",
                "122982492063411794748679486846712025743",
                "70055223555537779090618627245416227155",
                "278407526459132897023689066339921323388",
                "171015408578270390504277069528135727288",
                "59956767381036247421227055481916170081",
                "199855195880985592678694165805298387795",
                "56587465472147569711949691145540291435",
                "49092529647920979753878588590008952274",
                "335941595629939772858329856493410639848",
                "308643710447025022234891635367222869140",
                "139651431399215474826954841251542831791",
                "214035073228287550505256355664496029696",
                "130692463988565880116349430068527380382",
                "107675227408588248622124572173271184965",
                "239900118945973855481634615899383214274",
                "167739350410744706689733609075082183348",
                "232918463039926971304250766573751002199",
                "234979836855581334887100053758505591611",
                "230085558761537341043188732840828507914",
                "2300980870389297182646825862161037167",
                "168593989229972538956020571936728895172",
                "85231986509283043924671392572874311725",
                "57211279215175981959313999217226348049",
                "15797360756159055805688581807199088072",
                "58859372564532487629264464378520191591",
                "87245037093930279507550161088192441939",
                "292767372973411911840066620812680050183",
                "108938948122621712486916045911112197850",
                "86451819494095951587918272717643071444",
                "168346907436303588939846080783970690358",
                "12264276556495397295248752795736919610",
                "293615090964599541140893415841467141766",
                "151473302121008755545405351931660738242",
                "313448620549420115160652644068878463923",
                "181168789555319142323033025914915152774",
                "100444943740271509927590689182332470169",
                "97994783837552849036514143484982202872",
                "31692342978430635379947645709842017996",
                "299885490166893590773515554406239450894",
                "319351625577184108154836513368213903973",
                "221106328385406484255744894713466943629",
                "184510652254000794717803707726716516669",
                "263207381416855527049804944224639920140",
                "94618258313541067540648486526767745532",
                "339600767332854499011297395961648960797",
                "337861021567737393448209804731150846567",
                "297990189742550749852567350593875674165",
                "194553229314351146886423924341816490798",
                "304499437996138206655555400068072307455",
                "189995747934230693223104003398594213041",
                "168593683711223343843307515409350759483",
                "160637096922520217432231293295750333007",
                "171072754649135741775732524267073444733",
                "63967608657864750421861933791076895118",
                "337237532762744025451903163915050912454",
                "188433645941520912405207207490999102307",
                "181961330359982780568161324126326433630",
                "151764018362866901385552169287324665955",
                "236197110374509537491399842822370137183",
                "328101168163182682636789748162769390155",
                "40266399305598704868672079803202932182",
                "231153963697795594349193726305327258193",
                "117345025634151289436418257461035625962",
                "32256054811448420710326756811735983902",
                "189718871399804957834594627032223797187",
                "299037095462644973586998959190982680485",
                "130035304136670957021266710355716428715",
                "23864020850802888883507020227086427758",
                "176013702169044091622977016804697771127",
                "169953328329588678155743531555899045964",
                "263207381416855527049804944224639920140",
                "94618258313541067540648486526767745532",
                "339600767332854499011297395961648960797",
                "255811551950946065138846025809496751897",
                "262981111045435646654857619083522395075",
                "49185669747178745363973608509456353197",
                "48509806346032539693535241667245361758",
                "22370971211975831681955211281932825910",
                "234855630339470251550532353920201569441",
                "182073746560565181246740504537157544045",
                "304302226098587573699067863713439481299",
                "280418979272736928095628199852185190139",
                "306268590907995683173138330582503294805",
                "247997839589261909364084966809081835378",
                "276364822473813190267543789591862100892",
                "278502495635492419395442890920071289804",
                "16410016870829670609786535925922983038",
                "242434316797524430528747509131067792301",
                "287402364932843306477142758439316699909",
                "124227163690964647580931826890915486829",
                "101539826773178794101294693047120251261",
                "136663008889459848414204509668818647541",
                "251658294565924043294180728241266131652",
                "270615092404916271412560554050076117086",
                "83038165488141716048181740623137798354",
                "233140793450997564267608344607118076303",
                "338484169786427381757038222183394551414",
                "89495420251639546714783919949076674398",
                "193551055506391726930202485973270467319",
                "232412921327071816210475840815314472965",
                "317602014745481188066610599527190446491",
                "286892929111518851189603329488866885917",
                "124597503951845417762099101215093775027",
                "163590526302533120430210164083718436246",
                "94863346222886698738514104298303655376",
                "49874424961871650775080578947756206417",
                "69403928764622545058461633578645698570",
                "179683833325078778692359581293682728609",
                "135123572193573396096742872519224223510",
                "4337851534558212932438186906738491177",
                "251504806459571048892702086684301801163",
                "28967466038324588625245357437467625554",
                "166443248068788657372603091957406379638",
                "145833688627306160917180258649092632140",
                "249163351872990444441243353284879953774",
                "292068409172561087459471772736289919341",
                "281127346283262550209395735442841945088",
                "36619553932071795792262780155206425641",
                "189264911021146972095876902445728841824",
                "52439271662807240722076082275313116390",
                "252012039891070687586112171217359618958",
                "299030934311452378696406111189917397337",
                "169025036202753774460722198341099168582",
                "87867510265963218609299127115694040042",
                "326976870908718956657315388325498272723",
                "63029048788071621545810144534144453779",
                "2446963373332372115888932996722540653",
                "307538239057311015974352713875647623438",
                "177483600322845757492246568830374346594",
                "202083584392058349851810937015888097095",
                "147890332885368278525466837433247832894",
                "223760018065449802773269065965235934175",
                "119005825486589151620228838390581756434",
                "6063792147557138397660529083064310750",
                "276328204318563241289867988710811764557",
                "2208097465204364217884996174946414887",
                "8621849269753665380018532272513868618",
                "37399433774568951164072117700078355503",
                "168279008354891572479434373843490707249",
                "187431625616534575205483230483956718398",
                "82548236318306228112793627562807906239",
                "71914504196319928998063796795614753158",
                "35120855469546336540702396527878846679",
                "93908420276205843790112936408554448702",
                "232353197476981336078425473204030377815",
                "330647178867292037797193863210046992709",
                "16876510866489534886979964270977321465",
                "180942924123682614322430422957719114329",
                "265073358220821957797355550138126452405",
                "39112847120429578598063156296151727441",
                "11687563064051810443500329615972250574",
                "192875388969943517376401534597939960269",
                "82925330635874584485717900861055506480",
                "5279942880186077693664453975908770149",
                "109551222635884857131416474744991266218",
                "104969868386615514710679756637045272506",
                "166109828381023899767901851311553029765",
                "223136579834997428468416297206731010338",
                "263655133334005402201461712597103914550",
                "24771371969960323185156354927437106535",
                "122576831713992384238298010625136369471",
                "319168450944534618361922103010174505120",
                "119201814993872281437313772037735387356",
                "305489799375697893530728349153939088081",
                "2405629533215325154425848340005109153",
                "251586486708915817173786068559015613106",
                "313395019285006135002161168906286496797",
                "57789295132797724728245526006795757426",
                "308851027835066501609013863198874532961",
                "81659225916577809768250780515489000556",
                "232638924050906061306521824105115751328",
                "115333926917211875958584929106289578765",
                "145688388698438214393566022736780145953",
                "10412638026462816543343036045762793856",
                "62666701333358358478164003247468669324",
                "148587492052648845262448752329791071835",
                "32881744525000010202280493124180945162",
                "310806976239118229216194417003678200683",
                "265959031508086938388573267920474802650",
                "163461382502705815256551690350852729858",
                "178481190334589859389906834652606388126",
                "288843044507686339741074076524278316404",
                "262706798310098731025113572596587170474",
                "26497445316515035553359275524739548239",
                "98800935831166019630745950101134505964",
                "8621849269753665380018532272513868618",
                "313956129745585397960077229142160154291",
                "308835367749802472745423608597659132686",
                "72728770167996187114775891387459961124",
                "250182830154815195336494342816484580475",
                "264776139463444326090541457169730130094",
                "8621849269753665380018532272513868618",
                "313956129745585397960077229142160154291",
                "308835367749802472745423608597659132686",
                "72728770167996187114775891387459961124",
                "159292612267010913223935881918334924262",
                "34844249888551124507980894034160726391",
                "39112847120429578598063156296151727441",
                "18500244542872340110235934740667699371",
                "107432804228562515947747868744531154367",
                "91108783305923973519375981081194891936",
                "157316720709743791841463305457584350599",
                "230264200189041035955652582153294637198",
                "32621397257256393090864786378861823435",
                "39112847120429578598063156296151727441",
                "4061086314895041659593403660414432890",
                "288094559502802781377743308728536517495"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-54333-dd4e13fb",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/theopolis/uefi-firmware-parser/commit/bf3dfaa8a05675bae6ea0cbfa082ddcebfcde23e",
        "target": {
            "file": "uefi_firmware/compression/Tiano/Decompress.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "63243118276228064777087868179659714333",
            "length": 1003
        },
        "id": "CVE-2026-54333-e635153f",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/theopolis/uefi-firmware-parser/commit/bf3dfaa8a05675bae6ea0cbfa082ddcebfcde23e",
        "target": {
            "file": "uefi_firmware/compression/Tiano/Decompress.c",
            "function": "ReadPTLen"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "148792130782757254405890374286679407347",
            "length": 362
        },
        "id": "CVE-2026-54333-f2f1963b",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/theopolis/uefi-firmware-parser/commit/bf3dfaa8a05675bae6ea0cbfa082ddcebfcde23e",
        "target": {
            "file": "uefi_firmware/compression/Tiano/Decompress.c",
            "function": "GetInfo"
        }
    }
]
vanir_signatures_modified 
"2026-09-17T08:07:07Z"