EUVD-2026-78064
GHSA-2689-5p89-6j3j
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Parser must ingest an attacker-supplied file (AV:L/UI:R); crash is deterministic (A:H) while code execution is unconfirmed, so C/I set to L rather than H.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
5DescriptionCVE.org
UEFI Firmware Parser parses BIOS, Intel ME, and UEFI firmware structures including volumes, file systems, and files. Prior to 1.14, MakeTable() in uefi_firmware/compression/Tiano/Decompress.c does not validate that bit-length values read from a crafted Tiano or EFI compressed firmware bitstream remain within the expected range from 0 through 16. The normal CompressedSection.process() to efi_compressor.TianoDecompress() to TianoDecompress() to ReadPTLen() to MakeTable() parsing path can consequently write beyond the stack-allocated Count[17] array and related decode tables. The resulting stack corruption deterministically crashes the parsing process and may permit code execution depending on build and runtime details. This issue is fixed in version 1.14.
AnalysisAI
Stack out-of-bounds write in the theopolis uefi-firmware-parser Python library (versions prior to 1.14) lets a maliciously crafted Tiano/EFI-compressed firmware blob corrupt the parser's stack when it is decompressed. The bundled native Tiano decompressor's MakeTable() fails to validate Huffman bit-length values, so bit lengths above 16 overflow the stack-allocated Count[17] array and adjacent decode tables, deterministically crashing the parsing process and potentially allowing code execution in that process depending on build hardening. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the target to parse an attacker-supplied firmware blob that contains a crafted Tiano- or EFI-compressed section reaching the CompressedSection.process() → efi_compressor.TianoDecompress() → ReadPTLen() → MakeTable() path with a Huffman bit-length value greater than 16. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The input CVSS 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) overstates real-world risk for a firmware-analysis library. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to uefi-firmware-parser 1.14 or later (Vendor-released patch: 1.14), which replaces the forked decompressor with the hardened upstream EDK2 implementation carrying the CVE-2017-5731..5735 fixes; the fix is in commit bf3dfaa8a05675bae6ea0cbfa082ddcebfcde23e via PR https://github.com/theopolis/uefi-firmware-parser/pull/145. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all systems and applications using theopolis-uefi-firmware-parser versions prior to 1.14, with priority on identifying systems that process external or untrusted firmware files. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Uefi Firmware Parser
View allSame weakness CWE-787 – Out-of-bounds Write
View allShare
External POC / Exploit Code
Leaving vuln.today