CVE-2026-54333

UEFI Firmware Parser parses BIOS, Intel ME, and UEFI firmware structures including volumes, file systems, and files. Prior to 1.14, MakeTable() in uefi_firmware/compression/Tiano/Decompress.c does not validate that bit-length values read from a crafted Tiano or EFI compressed firmware bitstream remain within the expected range from 0 through 16. The normal CompressedSection.process() to efi_compressor.TianoDecompress() to TianoDecompress() to ReadPTLen() to MakeTable() parsing path can consequently write beyond the stack-allocated Count[17] array and related decode tables. The resulting stack corruption deterministically crashes the parsing process and may permit code execution depending on build and runtime details. This issue is fixed in version 1.14.

• CWE-787

• https://github.com/theopolis/uefi-firmware-parser/commit/bf3dfaa8a05675bae6ea0cbfa082ddcebfcde23e
• https://github.com/theopolis/uefi-firmware-parser/pull/145
• https://github.com/theopolis/uefi-firmware-parser/releases/tag/v1.14
• https://github.com/theopolis/uefi-firmware-parser/security/advisories/GHSA-2689-5p89-6j3j

Published

Sep 14, 2026

Last Modified

Sep 15, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-54327Pi is a minimal terminal coding harness. From 0.74.0 until 0…2.2
• CVE-2026-54328Pi is a minimal terminal coding harness. From 0.74.0 until 0…7.3
• CVE-2026-54329Snipe-IT is an IT asset/license management system. Prior to …7.7
• CVE-2026-5433Honeywell Control Network Module (CNM) contains command inje…9.1
• CVE-2026-54330Ceph is an open-source distributed storage platform providin…8.1
• CVE-2026-54332gopacket provides packet processing capabilities for Go. In …7.5
• CVE-2026-54334UEFI Firmware Parser parses BIOS, Intel ME, and UEFI firmwar…9.8
• CVE-2026-54335Feathersjs is a framework for creating web APIs and real-tim…3.7
• CVE-2026-54336JumpServer is an open source bastion host and an operation a…5.4
• CVE-2026-54337Fireshare facilitates self-hosted media and link sharing. Pr…9.8
• CVE-2026-54338JupyterHub is software that allows users to create a multi-u…5.3
• CVE-2026-54339Glean is a self-hosted RSS reader and personal knowledge man…7.7