CVE-2026-54334

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-54334

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54334.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-54334

Aliases

Published

2026-09-14T20:06:42Z

Modified

2026-09-17T03:47:28Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

UEFI Firmware Parser: Heap out-of-bounds write in tiano decompressor `ReadCLen`

Details

UEFI Firmware Parser parses BIOS, Intel ME, and UEFI firmware structures including volumes, file systems, and files. Prior to 1.14, ReadCLen() in uefi_firmware/compression/Tiano/Decompress.c reads Number from GetBits(Sd, CBIT) with CBIT = 9 and can obtain 511 entries for the 510-element Sd->mCLen heap array because its loop does not enforce Index < NC. The CharC == 2 run-length path can additionally request up to 531 zero writes through Sd->mCLen[Index++] = 0. The normal CompressedSection.process() to efi_compressor.TianoDecompress() to TianoDecompress() to DecodeC() to ReadCLen() parsing path therefore permits crafted Tiano or EFI compressed firmware to corrupt heap memory, deterministically crash the parsing process, and potentially execute code depending on build and runtime details. This issue is fixed in version 1.14.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-787"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54334.json"
}

References

Affected packages

Git / github.com/theopolis/uefi-firmware-parser

Affected ranges

Type

GIT

Repo

https://github.com/theopolis/uefi-firmware-parser

Events

Introduced

Fixed

bf3dfaa8a05675bae6ea0cbfa082ddcebfcde23e

Fixed

0475f5bfb158a74401cb8c10b75fbf4b4615b664

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.14"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v0.*

v0.2

v0.3

v0.4

v1.*

v1.0

v1.1

v1.10

v1.11

v1.12

v1.13

v1.2

v1.3

v1.4

v1.5

v1.6

v1.8

v1.9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54334.json"