{"id":"CVE-2026-54333","summary":"UEFI Firmware Parser: Stack out-of-bounds write in tiano decompressor MakeTable","details":"UEFI Firmware Parser parses BIOS, Intel ME, and UEFI firmware structures including volumes, file systems, and files. Prior to 1.14, MakeTable() in uefi_firmware/compression/Tiano/Decompress.c does not validate that bit-length values read from a crafted Tiano or EFI compressed firmware bitstream remain within the expected range from 0 through 16. The normal CompressedSection.process() to efi_compressor.TianoDecompress() to TianoDecompress() to ReadPTLen() to MakeTable() parsing path can consequently write beyond the stack-allocated Count[17] array and related decode tables. The resulting stack corruption deterministically crashes the parsing process and may permit code execution depending on build and runtime details. This issue is fixed in version 1.14.","aliases":["GHSA-2689-5p89-6j3j","PYSEC-2026-3393"],"modified":"2026-09-17T08:07:07.673485Z","published":"2026-09-14T20:05:19.783Z","database_specific":{"cwe_ids":["CWE-787"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54333.json","cna_assigner":"GitHub_M"},"references":[{"type":"WEB","url":"https://github.com/theopolis/uefi-firmware-parser/releases/tag/v1.14"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54333.json"},{"type":"ADVISORY","url":"https://github.com/theopolis/uefi-firmware-parser/security/advisories/GHSA-2689-5p89-6j3j"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54333"},{"type":"FIX","url":"https://github.com/theopolis/uefi-firmware-parser/commit/bf3dfaa8a05675bae6ea0cbfa082ddcebfcde23e"},{"type":"FIX","url":"https://github.com/theopolis/uefi-firmware-parser/pull/145"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/theopolis/uefi-firmware-parser","events":[{"introduced":"0"},{"fixed":"bf3dfaa8a05675bae6ea0cbfa082ddcebfcde23e"},{"fixed":"0475f5bfb158a74401cb8c10b75fbf4b4615b664"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"1.14"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["v1.13","v1.12","v1.11","v1.10","v1.9","v1.8","v1.6","v1.5","v1.4","v1.3","v1.2","v1.1","v1.0","v0.4","v0.3","v0.2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54333.json","vanir_signatures_modified":"2026-09-17T08:07:07Z","vanir_signatures":[{"id":"CVE-2026-54333-1dd3706e","signature_type":"Function","signature_version":"v1","source":"https://github.com/theopolis/uefi-firmware-parser/commit/bf3dfaa8a05675bae6ea0cbfa082ddcebfcde23e","target":{"file":"uefi_firmware/compression/Tiano/Decompress.c","function":"GetBits"},"deprecated":false,"digest":{"function_hash":"168915642553637055109770007137980449106","length":158}},{"signature_version":"v1","source":"https://github.com/theopolis/uefi-firmware-parser/commit/bf3dfaa8a05675bae6ea0cbfa082ddcebfcde23e","target":{"file":"uefi_firmware/compression/Tiano/Decompress.c","function":"Decode"},"deprecated":false,"digest":{"function_hash":"231586035991699415140513914683392944416","length":740},"id":"CVE-2026-54333-237fcf9e","signature_type":"Function"},{"target":{"file":"uefi_firmware/compression/Tiano/Decompress.c","function":"ReadCLen"},"deprecated":false,"digest":{"function_hash":"295221816256946835991417370092035669004","length":1179},"id":"CVE-2026-54333-48a5de99","signature_type":"Function","signature_version":"v1","source":"https://github.com/theopolis/uefi-firmware-parser/commit/bf3dfaa8a05675bae6ea0cbfa082ddcebfcde23e"},{"target":{"file":"uefi_firmware/compression/Tiano/Decompress.c","function":"Decompress"},"deprecated":false,"digest":{"function_hash":"236308454089365176463055686737274017035","length":1136},"id":"CVE-2026-54333-58840bb4","signature_type":"Function","signature_version":"v1","source":"https://github.com/theopolis/uefi-firmware-parser/commit/bf3dfaa8a05675bae6ea0cbfa082ddcebfcde23e"},{"id":"CVE-2026-54333-6bbc74b0","signature_type":"Function","signature_version":"v1","source":"https://github.com/theopolis/uefi-firmware-parser/commit/bf3dfaa8a05675bae6ea0cbfa082ddcebfcde23e","target":{"file":"uefi_firmware/compression/Tiano/Decompress.c","function":"DecodeP"},"deprecated":false,"digest":{"length":521,"function_hash":"304354982571552241150703015140628071442"}},{"source":"https://github.com/theopolis/uefi-firmware-parser/commit/bf3dfaa8a05675bae6ea0cbfa082ddcebfcde23e","target":{"file":"uefi_firmware/compression/Tiano/Decompress.c","function":"FillBuf"},"deprecated":false,"digest":{"function_hash":"120609890875909521396144982910569885672","length":618},"id":"CVE-2026-54333-7978163a","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/theopolis/uefi-firmware-parser/commit/bf3dfaa8a05675bae6ea0cbfa082ddcebfcde23e","target":{"file":"uefi_firmware/compression/Tiano/Decompress.c","function":"DecodeC"},"deprecated":false,"digest":{"function_hash":"327922903935396794745552192436932201357","length":776},"id":"CVE-2026-54333-be94d4f3","signature_type":"Function","signature_version":"v1"},{"target":{"file":"uefi_firmware/compression/Tiano/Decompress.c","function":"MakeTable"},"deprecated":false,"digest":{"function_hash":"123778443143049853070216025773322630235","length":1741},"id":"CVE-2026-54333-cba4da29","signature_type":"Function","signature_version":"v1","source":"https://github.com/theopolis/uefi-firmware-parser/commit/bf3dfaa8a05675bae6ea0cbfa082ddcebfcde23e"},{"deprecated":false,"digest":{"line_hashes":["307426451347538762343545216512842160228","66288153098642525271321119945283865256","76548913602661675534357728792108866178","282447343167205313530532876643709723437","300950909299627676634687633847218747204","43892107581312900241197486217805257031","6545500975843914034601616341977562744","257825656422195845641328285653436027264","2952171528893766223051615397340815507","303570211248613924433784989928780018136","282453620855761066360856317003397386575","168124110974913465547005908794600319036","297415635232805751042281652646928186024","237042347066964586934568369472674973167","310258503744878652528668928688072934546","70713752466510987824694127893737143918","64743642575619694282511583604146307986","113786527940579199407872064235362666313","235299109818653373577257448733762295509","165437673747693382710771502167116955060","199591741621485175847582595992444228314","319943654453009403918259634573886575583","46941706312816900157054286858439084295","84541602497815943992084028965126332680","16847455622719174515123294476296525740","200213660596776669767307213399604649506","91607226550314636789804946846695203192","103966262535189541982718431697659970505","325793465208619326208777317157573036265","323132300614697086509196194743224261765","45705717158140727721996568071553749152","182595905682853098410415664344212981371","336370517005707208275164085299123929675","143663900752738565746415591356472017394","114653703446493081232850292372957229062","55228180925137447548853841081062069203","95089496467827505850004352236521622976","52888867224953026507431235929332959677","61357188310163696116723713001920591021","196144394833499856191417693415536718082","246284847181927529785790189449831599285","14342132865357290621467331781312191828","218249309072904675372184929294730952725","45705717158140727721996568071553749152","14170566339067707731027641152141768378","107875313803737230445463492073394263943","99721832672393874059797316902865130793","118547233183666882408988192777769538176","111377815153245094241456978005591879445","265402046805237174914205136103432571235","142748310322121910908625734691070081760","195857695351971747109941769796142204711","224420571170294979914439959293411956649","109278998348679015136860594132424693681","165900074708433812581926788174318740410","308292806611236488504568074992806671649","96725031613663627557465940103963784772","330218531618179447527472321022675882872","288876893049086862454978489836082033168","274993252410921937334802130311558715560","315076494824132104331955142632684549785","44661990808471457500232751107560176012","123487395793672684721321972079656264815","218772025796675743642843467946530580160","218344874421128252165720898089663083287","321225085073448864499981566313216732514","146159226621925405162324924136501818861","276940672434111124493513576738044410309","82158241590756313041306416203101969225","143709577662559395155071849245623140476","217971553085322599141349791298717544598","30751639405221518372484144391367605425","157105067954470819528234717452150403145","282237489071404505929221706812231158170","297519917884373405223387785464388859474","182372289482748796245313674810860875755","135915489522974077136883858239841517553","122982492063411794748679486846712025743","70055223555537779090618627245416227155","278407526459132897023689066339921323388","171015408578270390504277069528135727288","59956767381036247421227055481916170081","199855195880985592678694165805298387795","56587465472147569711949691145540291435","49092529647920979753878588590008952274","335941595629939772858329856493410639848","308643710447025022234891635367222869140","139651431399215474826954841251542831791","214035073228287550505256355664496029696","130692463988565880116349430068527380382","107675227408588248622124572173271184965","239900118945973855481634615899383214274","167739350410744706689733609075082183348","232918463039926971304250766573751002199","234979836855581334887100053758505591611","230085558761537341043188732840828507914","2300980870389297182646825862161037167","168593989229972538956020571936728895172","85231986509283043924671392572874311725","57211279215175981959313999217226348049","15797360756159055805688581807199088072","58859372564532487629264464378520191591","87245037093930279507550161088192441939","292767372973411911840066620812680050183","108938948122621712486916045911112197850","86451819494095951587918272717643071444","168346907436303588939846080783970690358","12264276556495397295248752795736919610","293615090964599541140893415841467141766","151473302121008755545405351931660738242","313448620549420115160652644068878463923","181168789555319142323033025914915152774","100444943740271509927590689182332470169","97994783837552849036514143484982202872","31692342978430635379947645709842017996","299885490166893590773515554406239450894","319351625577184108154836513368213903973","221106328385406484255744894713466943629","184510652254000794717803707726716516669","263207381416855527049804944224639920140","94618258313541067540648486526767745532","339600767332854499011297395961648960797","337861021567737393448209804731150846567","297990189742550749852567350593875674165","194553229314351146886423924341816490798","304499437996138206655555400068072307455","189995747934230693223104003398594213041","168593683711223343843307515409350759483","160637096922520217432231293295750333007","171072754649135741775732524267073444733","63967608657864750421861933791076895118","337237532762744025451903163915050912454","188433645941520912405207207490999102307","181961330359982780568161324126326433630","151764018362866901385552169287324665955","236197110374509537491399842822370137183","328101168163182682636789748162769390155","40266399305598704868672079803202932182","231153963697795594349193726305327258193","117345025634151289436418257461035625962","32256054811448420710326756811735983902","189718871399804957834594627032223797187","299037095462644973586998959190982680485","130035304136670957021266710355716428715","23864020850802888883507020227086427758","176013702169044091622977016804697771127","169953328329588678155743531555899045964","263207381416855527049804944224639920140","94618258313541067540648486526767745532","339600767332854499011297395961648960797","255811551950946065138846025809496751897","262981111045435646654857619083522395075","49185669747178745363973608509456353197","48509806346032539693535241667245361758","22370971211975831681955211281932825910","234855630339470251550532353920201569441","182073746560565181246740504537157544045","304302226098587573699067863713439481299","280418979272736928095628199852185190139","306268590907995683173138330582503294805","247997839589261909364084966809081835378","276364822473813190267543789591862100892","278502495635492419395442890920071289804","16410016870829670609786535925922983038","242434316797524430528747509131067792301","287402364932843306477142758439316699909","124227163690964647580931826890915486829","101539826773178794101294693047120251261","136663008889459848414204509668818647541","251658294565924043294180728241266131652","270615092404916271412560554050076117086","83038165488141716048181740623137798354","233140793450997564267608344607118076303","338484169786427381757038222183394551414","89495420251639546714783919949076674398","193551055506391726930202485973270467319","232412921327071816210475840815314472965","317602014745481188066610599527190446491","286892929111518851189603329488866885917","124597503951845417762099101215093775027","163590526302533120430210164083718436246","94863346222886698738514104298303655376","49874424961871650775080578947756206417","69403928764622545058461633578645698570","179683833325078778692359581293682728609","135123572193573396096742872519224223510","4337851534558212932438186906738491177","251504806459571048892702086684301801163","28967466038324588625245357437467625554","166443248068788657372603091957406379638","145833688627306160917180258649092632140","249163351872990444441243353284879953774","292068409172561087459471772736289919341","281127346283262550209395735442841945088","36619553932071795792262780155206425641","189264911021146972095876902445728841824","52439271662807240722076082275313116390","252012039891070687586112171217359618958","299030934311452378696406111189917397337","169025036202753774460722198341099168582","87867510265963218609299127115694040042","326976870908718956657315388325498272723","63029048788071621545810144534144453779","2446963373332372115888932996722540653","307538239057311015974352713875647623438","177483600322845757492246568830374346594","202083584392058349851810937015888097095","147890332885368278525466837433247832894","223760018065449802773269065965235934175","119005825486589151620228838390581756434","6063792147557138397660529083064310750","276328204318563241289867988710811764557","2208097465204364217884996174946414887","8621849269753665380018532272513868618","37399433774568951164072117700078355503","168279008354891572479434373843490707249","187431625616534575205483230483956718398","82548236318306228112793627562807906239","71914504196319928998063796795614753158","35120855469546336540702396527878846679","93908420276205843790112936408554448702","232353197476981336078425473204030377815","330647178867292037797193863210046992709","16876510866489534886979964270977321465","180942924123682614322430422957719114329","265073358220821957797355550138126452405","39112847120429578598063156296151727441","11687563064051810443500329615972250574","192875388969943517376401534597939960269","82925330635874584485717900861055506480","5279942880186077693664453975908770149","109551222635884857131416474744991266218","104969868386615514710679756637045272506","166109828381023899767901851311553029765","223136579834997428468416297206731010338","263655133334005402201461712597103914550","24771371969960323185156354927437106535","122576831713992384238298010625136369471","319168450944534618361922103010174505120","119201814993872281437313772037735387356","305489799375697893530728349153939088081","2405629533215325154425848340005109153","251586486708915817173786068559015613106","313395019285006135002161168906286496797","57789295132797724728245526006795757426","308851027835066501609013863198874532961","81659225916577809768250780515489000556","232638924050906061306521824105115751328","115333926917211875958584929106289578765","145688388698438214393566022736780145953","10412638026462816543343036045762793856","62666701333358358478164003247468669324","148587492052648845262448752329791071835","32881744525000010202280493124180945162","310806976239118229216194417003678200683","265959031508086938388573267920474802650","163461382502705815256551690350852729858","178481190334589859389906834652606388126","288843044507686339741074076524278316404","262706798310098731025113572596587170474","26497445316515035553359275524739548239","98800935831166019630745950101134505964","8621849269753665380018532272513868618","313956129745585397960077229142160154291","308835367749802472745423608597659132686","72728770167996187114775891387459961124","250182830154815195336494342816484580475","264776139463444326090541457169730130094","8621849269753665380018532272513868618","313956129745585397960077229142160154291","308835367749802472745423608597659132686","72728770167996187114775891387459961124","159292612267010913223935881918334924262","34844249888551124507980894034160726391","39112847120429578598063156296151727441","18500244542872340110235934740667699371","107432804228562515947747868744531154367","91108783305923973519375981081194891936","157316720709743791841463305457584350599","230264200189041035955652582153294637198","32621397257256393090864786378861823435","39112847120429578598063156296151727441","4061086314895041659593403660414432890","288094559502802781377743308728536517495"],"threshold":0.9},"id":"CVE-2026-54333-dd4e13fb","signature_type":"Line","signature_version":"v1","source":"https://github.com/theopolis/uefi-firmware-parser/commit/bf3dfaa8a05675bae6ea0cbfa082ddcebfcde23e","target":{"file":"uefi_firmware/compression/Tiano/Decompress.c"}},{"digest":{"function_hash":"63243118276228064777087868179659714333","length":1003},"id":"CVE-2026-54333-e635153f","signature_type":"Function","signature_version":"v1","source":"https://github.com/theopolis/uefi-firmware-parser/commit/bf3dfaa8a05675bae6ea0cbfa082ddcebfcde23e","target":{"file":"uefi_firmware/compression/Tiano/Decompress.c","function":"ReadPTLen"},"deprecated":false},{"target":{"file":"uefi_firmware/compression/Tiano/Decompress.c","function":"GetInfo"},"deprecated":false,"digest":{"function_hash":"148792130782757254405890374286679407347","length":362},"id":"CVE-2026-54333-f2f1963b","signature_type":"Function","signature_version":"v1","source":"https://github.com/theopolis/uefi-firmware-parser/commit/bf3dfaa8a05675bae6ea0cbfa082ddcebfcde23e"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}