{"items":[{"id":"NVI-00017560","kind":"vulnerability","title":"UEFI Firmware Parser has a heap out-of-bounds write in tiano decompressor ReadCLen","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-hm2w-vr2p-hq7w","CVE-2026-54334"],"plain_summary":"GitHub lists this reviewed advisory for uefi-firmware. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-20192aec791f25f15d98f34c96b7852c"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-07-08T17:32:56.000Z","value":"9.8 critical","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-20192aec791f25f15d98f34c96b7852c"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-20192aec791f25f15d98f34c96b7852c","url":"https://github.com/advisories/GHSA-hm2w-vr2p-hq7w","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-hm2w-vr2p-hq7w","publisher":"GitHub Advisory Database","observed_at":"2026-11-04T23:34:51.634Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-20192aec791f25f15d98f34c96b7852c"],"technology":"uefi-firmware","known_exclusions":[],"conditions_summary":"`uefi-firmware` contains a heap out-of-bounds write vulnerability in the native tiano/EFI decompressor. in `uefi_firmware/compression/Tiano/Decompress.c`, `ReadCLen()` reads `Number = GetBits(Sd, CBIT)` with `CBIT = 9`, so `Number` can be as large as `511`, while the destination array `Sd->mCLen` has `NC = 510` elements. the loop writes while `Index mCLen[Index++] = 0`.\n\nReachability is through the normal parsing path: `CompressedSection.process()` -> `efi_compressor.TianoDecompress()` -> `TianoDecompress()` -> `DecodeC()` -> `ReadCLen()`.\n\nMinimum impact is a deterministic crash; depending on build/runtime details, the heap memory corruption may be exploitable for code execution in the context of the parsing process. this project shipped its own copy of the decompressor without the upstream EDK2 hardening for this bug class.\n\n- PR: \n- fix commit: \n- upstream re","public_affected_ranges":["<= 1.12"]}],"null_published_at":"2026-11-05T19:10:21.415Z","source_updated_at":"2026-07-08T17:32:56.000Z","source_disclosed_at":"2026-04-16T01:31:09.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-04T23:34:51.634Z"}],"next_cursor":null,"snapshot_revision":"42594"}