Executive brief
The UEFI Firmware Parser, a tool used to analyze and extract data from system firmware, contains a memory corruption flaw in its decompression component. An attacker could provide a specially crafted firmware file that, when processed, causes the application to crash or potentially execute unauthorized code. This could lead to a complete compromise of the system running the parser or a disruption of firmware analysis operations.
Technical details
A heap out-of-bounds write exists in the ReadCLen() function within uefi_firmware/compression/Tiano/Decompress.c. The function reads a bitfield value that can reach 511, but the destination array Sd->mCLen is limited to 510 elements, and a run-length encoding path (CharC == 2) can further extend this write up to 531 elements. The vulnerability is reachable via the normal parsing path when processing compressed sections. This implementation lacks the hardening measures present in upstream EDK2. A fix is available in the project's repository, though a specific versioned release is not noted beyond the commit.
Affected products
- theopolis uefi-firmware-parser <= 1.12
Timeline
- 2026-04-14: disclosed: Advisory published by vendor
- 2026-04-16: advisory: GitHub Advisory reviewed and published