Systems using TianoCore EDK2 firmware images that include the affected Brotli decompressor code are potentially exposed. The report notes that the researcher scanned 200 shipping firmware images but does not identify any confirmed deployments using it.
The attacker needs control over a compressed firmware image or Brotli-compressed content processed by the affected DXE decompressor. They can declare a small decoded output size, or trigger UINT64-to-UINT32 truncation, causing allocation of an undersized destination buffer before decompression writes beyond it.
No. The overflow occurs in DXE before Secure Boot, according to the report. The demonstrated impact includes overwriting the Secure Boot flag and adjacent pool objects.
Review firmware source and built images for BrotliDecompress.c and the BrotliDecompressInternal path. The affected behavior is an output buffer write that continues until the Brotli stream ends without enforcing the allocated destination-buffer size, along with unvalidated conversion of a decoded UINT64 size to UINT32.