UEFI Firmware Parser has a heap out-of-bounds write in tiano decompressor ReadCLen
uefi-firmware contains a heap out-of-bounds write vulnerability in the native tiano/EFI decompressor. in uefi_firmware/compression/Tiano/Decompress.c, ReadCLen() reads Number = GetBits(Sd, CBIT) with CBIT = 9, so Number can be as large as 511, while the destination array Sd->mCLen has NC = 510 elements. the loop writes while Index < Number without enforcing Index < NC. additionally, the CharC == 2 run-length path performs GetBits(Sd, 9) + 20, allowing up to 531 zero writes through Sd->mCLen[Index++] = 0.
Reachability is through the normal parsing path: CompressedSection.process() -> efi_compressor.TianoDecompress() -> TianoDecompress() -> DecodeC() -> ReadCLen().
Minimum impact is a deterministic crash; depending on build/runtime details, the heap memory corruption may be exploitable for code execution in the context of the parsing process. this project shipped its own copy of the decompressor without the upstream EDK2 hardening for this bug class.
- PR: https://github.com/theopolis/uefi-firmware-parser/pull/145
- fix commit: https://github.com/theopolis/uefi-firmware-parser/commit/bf3dfaa8a05675bae6ea0cbfa082ddcebfcde23e
- upstream related fixes: CVE-2017-5731, CVE-2017-5732, CVE-2017-5733, CVE-2017-5734, CVE-2017-5735
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | uefi-firmware | <= 1.12 | no fix |
References
- https://github.com/theopolis/uefi-firmware-parser/security/advisories/GHSA-hm2w-vr2p-hq7w
- https://github.com/theopolis/uefi-firmware-parser/pull/145
- https://github.com/theopolis/uefi-firmware-parser/commit/bf3dfaa8a05675bae6ea0cbfa082ddcebfcde23e
- https://github.com/theopolis/uefi-firmware-parser
- https://pypi.org/project/uefi-firmware
- https://github.com/advisories/GHSA-hm2w-vr2p-hq7w
- https://nvd.nist.gov/vuln/detail/CVE-2026-54334
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H- Weakness (CWE)
CWE-787- Platform
- Python (PyPI)
- Package
uefi-firmware- Disclosed
- 16.04.2026
- Updated
- 11.10.2026 14:18
Sources and licenses
OSV / GitHub Advisory Database - PYSEC-2026-3394 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-hm2w-vr2p-hq7w - CC BY 4.0
Vulnerability history: uefi-firmware
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 2
- First → latest
- 04.2026 04.2026
- Without a fix
- 2
- Exploited in attacks
- 0
Severity breakdown
- Critical 2
Disclosures per year
- 2026: 2
-
UEFI Firmware Parser has a heap out-of-bounds write in tiano decompressor ReadCLen this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.