CVE-2026-54334: UEFI Firmware Parser: Heap out-of-bounds write in tiano decompressor `ReadCLen`
UEFI Firmware Parser parses BIOS, Intel ME, and UEFI firmware structures including volumes, file systems, and files. Prior to 1.14, ReadCLen() in uefifirmware/compression/Tiano/Decompress.c reads Number from GetBits(Sd, CBIT) with CBIT = 9 and can obtain 511 entries for the 510-element Sd->mCLen heap array because its loop does not enforce Index < NC. The CharC == 2 run-length path can additionally request up to 531 zero writes through Sd->mCLen[Index++] = 0. The normal CompressedSection.process() to eficompressor.TianoDecompress() to TianoDecompress() to DecodeC() to ReadCLen() parsing path therefore permits crafted Tiano or EFI compressed firmware to corrupt heap memory, deterministically crash the parsing process, and potentially execute code depending on build and runtime details. This issue is fixed in version 1.14.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
UEFI Firmware Parser (tiano decompressor)to a version that resolves this vulnerability.Fixed in 1.14
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using UEFI Firmware Parser versions prior to 1.14 are affected when they parse attacker-crafted Tiano- or EFI-compressed firmware data. The vulnerable path is the normal compressed-section processing path.
What does an attacker need to exploit it?
An attacker needs to cause the parser to process a crafted Tiano or EFI compressed firmware input. No privileges or user interaction are required according to the supplied severity vector.
What is the impact if exploitation succeeds?
The crafted compressed data can write beyond the mCLen heap array, deterministically crashing the parsing process. It may also permit code execution, depending on build and runtime details.
What should be done if the parser must handle untrusted firmware?
Upgrade to version 1.14, which fixes the issue. Until then, avoid processing untrusted or attacker-supplied Tiano- or EFI-compressed firmware with affected versions.