EUVD-2026-78065
GHSA-hm2w-vr2p-hq7w
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
A file-parsing library exploited only when a victim feeds it a crafted image, so AV:L/UI:R; confirmed impact is a deterministic crash (A:H) with limited, mostly-zero OOB writes making C/I only Low.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
5DescriptionCVE.org
UEFI Firmware Parser parses BIOS, Intel ME, and UEFI firmware structures including volumes, file systems, and files. Prior to 1.14, ReadCLen() in uefi_firmware/compression/Tiano/Decompress.c reads Number from GetBits(Sd, CBIT) with CBIT = 9 and can obtain 511 entries for the 510-element Sd->mCLen heap array because its loop does not enforce Index < NC. The CharC == 2 run-length path can additionally request up to 531 zero writes through Sd->mCLen[Index++] = 0. The normal CompressedSection.process() to efi_compressor.TianoDecompress() to TianoDecompress() to DecodeC() to ReadCLen() parsing path therefore permits crafted Tiano or EFI compressed firmware to corrupt heap memory, deterministically crash the parsing process, and potentially execute code depending on build and runtime details. This issue is fixed in version 1.14.
AnalysisAI
Heap out-of-bounds write in the theopolis uefi-firmware-parser Python package (versions prior to 1.14) lets a crafted Tiano/EFI-compressed firmware image corrupt heap memory when the file is parsed. The bundled native Tiano decompressor's ReadCLen() in Decompress.c reads a 9-bit length (up to 511, plus a run-length path allowing up to 531 writes) into the 510-element Sd->mCLen array without an Index < NC bound, producing a deterministic crash and potential code execution in the parsing process. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the victim to parse an attacker-supplied firmware image containing a maliciously crafted Tiano-compressed or EFI-compressed section, and requires the vulnerable code path to run - i.e., uefi-firmware-parser < 1.14 with its native efi_compressor/Tiano decompressor invoked via CompressedSection.process(). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The published CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H = 9.8) overstates real-world exposure for a file-parsing library: the vulnerability is not a listening network service but is triggered only when the parser is fed attacker-controlled firmware, which in most deployments is a local or supply-chain action rather than direct remote unauthenticated access, so a more honest read is AV:L or AV:N with UI:R and a lower complexity of successful RCE. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to uefi-firmware-parser 1.14 or later (pip install -U uefi-firmware), which replaces the forked decompressor with the upstream EDK2 implementation carrying the CVE-2017-5731..5735 bounds fixes; see the fix commit https://github.com/theopolis/uefi-firmware-parser/commit/bf3dfaa8a05675bae6ea0cbfa082ddcebfcde23e, PR https://github.com/theopolis/uefi-firmware-parser/pull/145, and release https://github.com/theopolis/uefi-firmware-parser/releases/tag/v1.14. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems and tools using uefi-firmware-parser, document their current versions, and determine whether they process firmware from untrusted or external sources. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Uefi Firmware Parser
View allSame weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today