Executive brief
The uefi-firmware-parser library, used for analyzing and extracting UEFI firmware images, contains a memory corruption vulnerability. An attacker could provide a specially crafted firmware file that, when parsed, causes the application to crash or potentially execute malicious code. This could lead to a complete compromise of the system performing the firmware analysis.
Technical details
A stack-based out-of-bounds write exists in the Tiano decompressor component of uefi-firmware-parser. The vulnerability is located in the `MakeTable()` function within `uefi_firmware/compression/Tiano/Decompress.c`, which fails to validate that bit-length values read from a compressed bitstream are within the valid 0-16 range. By supplying values greater than 16 in a crafted firmware blob, an attacker can trigger an out-of-bounds write to the stack-allocated `Count[17]` array. This can lead to deterministic crashes or arbitrary code execution. The issue stems from the project using a version of the decompressor that lacks upstream EDK2 hardening. A fix is available in the project's GitHub repository.
Affected products
- theopolis uefi-firmware-parser <= 1.12
Timeline
- 2026-04-14: disclosed: Initial disclosure to theopolis/uefi-firmware-parser
- 2026-04-16: advisory: GitHub Advisory published