A critical out-of-bounds write vulnerability in theopolis uefi-firmware-parser, version 1.14 and earlier, poses a severe risk of remote code execution.

The vulnerability exists in the MakeTable function within Tiano/Decompress.c, where insufficient validation of bit-length values leads to an out-of-bounds write on the stack. An unauthenticated attacker can supply a malicious firmware bitstream to trigger memory corruption and potential code execution.

This vulnerability carries a CVSS score of 9.8, indicating a critical severity level. Successful exploitation allows an attacker to gain control over the parsing process, which may lead to full system compromise, loss of data integrity, and denial of service. Organizations relying on this library to analyze firmware structures are at significant risk if they process untrusted files.

Immediate Action: Update theopolis uefi-firmware-parser to version 1.14 or later immediately to incorporate the necessary bounds checking.

Proactive Monitoring: Monitor systems for unexpected application crashes or abnormal process termination when parsing firmware files, as these may indicate exploitation attempts.

Compensating Controls: Implement strict input validation or sandboxing for any service that processes external or untrusted firmware files to limit the impact of potential memory corruption.

Public Exploit Available: No

Given the critical nature of this memory corruption vulnerability and the potential for remote code execution, immediate remediation is required. Administrators should verify their environment for instances of the uefi-firmware-parser and upgrade to version 1.14 without delay to eliminate the risk of exploitation.