CVE-2026-54333: UEFI Firmware Parser Buffer Overflow Flaw

CVE-2026-54333 Overview

CVE-2026-54333 is a stack-based out-of-bounds write [CWE-787] in the uefi-firmware-parser Python library, which parses BIOS, Intel Management Engine (ME), and Unified Extensible Firmware Interface (UEFI) firmware structures. Versions prior to 1.14 fail to validate bit-length values read from Tiano or EFI compressed firmware bitstreams inside MakeTable() in uefi_firmware/compression/Tiano/Decompress.c. A crafted compressed section can force writes beyond the stack-allocated Count[17] array and related decode tables. The result is deterministic stack corruption during parsing and, depending on build and runtime characteristics, possible arbitrary code execution in the parser process.

Critical Impact
A malicious firmware image processed by any pipeline using uefi-firmware-parser below 1.14 can crash the parser and may enable remote code execution in analysis or automation workflows.

Affected Products

uefi-firmware-parser versions prior to 1.14
Downstream firmware analysis tools and CI pipelines that embed the library
Automated malware and firmware triage systems ingesting untrusted UEFI images

Discovery Timeline

2026-09-14 - CVE-2026-54333 published to the National Vulnerability Database (NVD)
2026-09-15 - Last updated in NVD database
Fix released - Addressed in uefi-firmware-parser v1.14 via GitHub Pull Request #145 and commit bf3dfaa

Technical Details for CVE-2026-54333

Vulnerability Analysis

The flaw lives inside the Tiano/EFI decompression routines that uefi-firmware-parser inherits from the EDK II reference code. When a compressed UEFI section is parsed, control flows from CompressedSection.process() into efi_compressor.TianoDecompress(), then TianoDecompress(), ReadPTLen(), and finally MakeTable(). MakeTable() builds Huffman decode tables using bit-length values supplied by the attacker-controlled bitstream. The routine assumes those bit-length values fall within 0 through 16, matching the size of the stack-resident Count[17] array. Because the input is never bounded-checked, oversized bit-length values cause the function to index and write past Count[17] and adjacent decode structures, corrupting the stack frame. See the GitHub Security Advisory GHSA-2689-5p89-6j3j for full details.

Root Cause

The root cause is missing input validation on Huffman bit-length symbols read from an untrusted compressed bitstream. MakeTable() trusts the decoded values as loop and array indices without enforcing the [0, 16] invariant, producing a classic stack out-of-bounds write [CWE-787].

Attack Vector

Exploitation requires only that a vulnerable parser process a crafted UEFI, BIOS, or Intel ME image. Because many consumers of the library are automated pipelines (firmware scanners, CI systems, malware sandboxes, threat intelligence enrichers), an attacker can deliver a malicious image over the network, through a firmware update channel, or via a submitted sample. No authentication or user interaction is required beyond triggering the parser.

Verified proof-of-concept code is not published. See the security advisory for technical details:
https://github.com/theopolis/uefi-firmware-parser/security/advisories/GHSA-2689-5p89-6j3j

Detection Methods for CVE-2026-54333

Indicators of Compromise

Unexpected crashes, segmentation faults, or Python SIGSEGV terminations in processes invoking uefi-firmware-parser, uefi_firmware.compression, or efi_compressor.
Firmware analysis workers restarting or job queues stalling immediately after ingesting a new UEFI, BIOS, or Intel ME image.
Malformed Tiano or EFI compressed sections in submitted firmware samples whose Huffman bit-length symbols exceed 16.

Detection Strategies

Inventory Python environments and container images for installed versions of uefi-firmware-parser using pip show or software bill of materials (SBOM) tooling, and flag any version below 1.14.
Instrument firmware parsing services with crash reporting to capture stack traces referencing MakeTable, ReadPTLen, or TianoDecompress.
Add pre-parse validation that rejects compressed sections whose declared bit-length codes fall outside the [0, 16] range before handing data to the vulnerable path.

Monitoring Recommendations

Monitor host telemetry for parser processes spawning unexpected child processes or writing to non-standard filesystem paths after firmware ingestion.
Alert on repeated abnormal terminations of analysis workers correlated with specific submitted samples so operators can quarantine the offending image.
Log and retain the SHA-256 hashes of firmware images processed by vulnerable parsers to support post-incident review.

How to Mitigate CVE-2026-54333

Immediate Actions Required

Upgrade uefi-firmware-parser to version 1.14 or later on every host, container, and CI runner that processes firmware.
Rebuild and redeploy downstream tools, sandboxes, and SaaS analyzers that bundle the library so the fixed code path is loaded.
Isolate firmware parsing workloads in dedicated, low-privilege sandboxes to contain the impact of any residual parser crash.

Patch Information

The issue is fixed in uefi-firmware-parser 1.14. The corrective change adds bounds validation to MakeTable() so bit-length values outside [0, 16] are rejected before indexing Count[17]. See commit bf3dfaa, Pull Request #145, and the v1.14 release notes.

Workarounds

If patching is not immediately possible, disable Tiano and EFI decompression code paths in wrapper code and skip compressed sections.
Run the parser under strict resource and syscall confinement using seccomp, containers, or virtual machines with no network egress.
Restrict firmware submission to authenticated internal sources until upgrades complete.

bash

# Upgrade to the fixed release
pip install --upgrade 'uefi-firmware-parser>=1.14'

# Verify the installed version
python -c "import uefi_firmware; print(uefi_firmware.__version__)"