Description

UEFI Firmware Parser parses BIOS, Intel ME, and UEFI firmware structures including volumes, file systems, and files. Prior to 1.14, MakeTable() in uefi_firmware/compression/Tiano/Decompress.c does not validate that bit-length values read from a crafted Tiano or EFI compressed firmware bitstream remain within the expected range from 0 through 16. The normal CompressedSection.process() to efi_compressor.TianoDecompress() to TianoDecompress() to ReadPTLen() to MakeTable() parsing path can consequently write beyond the stack-allocated Count[17] array and related decode tables. The resulting stack corruption deterministically crashes the parsing process and may permit code execution depending on build and runtime details. This issue is fixed in version 1.14.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-14T20:16:45.990Z",
  "pubdate": "2026-09-14T20:16:45.990Z",
  "executiveSummary": "The UEFI Firmware Parser is susceptible to a critical stack-based buffer overflow vulnerability residing within its Tiano decompression logic. This flaw, present in versions prior to 1.14, arises from inadequate input validation during the processing of crafted firmware bitstreams. Specifically, the MakeTable() function fails to enforce boundary constraints on bit-length values, which are subsequently used to index and populate stack-allocated arrays.\nThe vulnerability allows a remote or local attacker to trigger memory corruption by supplying a malicious Tiano or EFI compressed firmware image. Successful exploitation leads to a deterministic crash of the parsing process and presents a significant risk of arbitrary code execution, depending on the specific environment, build-time protections, and runtime memory layout. The impact is severe, as it compromises the integrity of firmware analysis tools used in security research and forensic workflows. No specific authentication is required, as the vulnerability is triggered during the routine parsing of binary input. Users are strongly advised to update to version 1.14 or later to remediate the flaw.",
  "technicalDetails": "The root cause of this vulnerability is a missing bounds check in the MakeTable() function located within uefi_firmware/compression/Tiano/Decompress.c. When the parser processes a Tiano or EFI compressed section, the execution flow proceeds through CompressedSection.process(), invokes efi_compressor.TianoDecompress(), and calls TianoDecompress() before reaching ReadPTLen() and finally MakeTable().\nDuring the execution of MakeTable(), the function reads bit-length values directly from the provided compressed bitstream. The logic is designed to populate a stack-allocated buffer identified as Count[17] and associated decoding tables. Because the bit-length values are not validated to fall within the expected integer range of 0 through 16, an attacker can supply crafted bit-length values that exceed this range. When these malformed values are used as array indices or for loop iterations, the parser performs out-of-bounds writes into the stack memory adjacent to the Count[17] array.\nThe attack flow begins when an attacker provides a maliciously crafted firmware image to the parser. As the parser attempts to decompress the image, the lack of sanitization in MakeTable() results in the overflow of the stack frame. This overwrites critical memory segments, including stored function return addresses, saved base pointers, or local variables. Because the offset and value of the overwrite are controlled by the bitstream input, the corruption is deterministic.\nThe impact of the stack corruption ranges from a denial-of-service, manifested as a segmentation fault or process crash, to potentially controlled code execution. If an attacker can overwrite return pointers with a controlled memory address, they may redirect execution to a payload (e.g., shellcode) or a Return-Oriented Programming (ROP) chain, provided that platform-specific protections such as stack canaries, Address Space Layout Randomization (ASLR), or Data Execution Prevention (DEP) are absent or can be bypassed. The complexity of successful exploitation depends heavily on the specific binary build and the runtime environment in which the UEFI Firmware Parser is executing. No authentication is necessary, and the attack surface is exposed whenever the parser processes untrusted firmware blobs."
}