A critical out-of-bounds write vulnerability in theopolis uefi-firmware-parser versions prior to 1.14 poses a severe risk of memory corruption and potential remote code execution.

The vulnerability exists in the ReadCLen function within Tiano/Decompress.c, where insufficient bounds checking during the parsing of compressed firmware structures allows an unauthenticated attacker to trigger an out-of-bounds heap write. This flaw can lead to deterministic process crashes or the execution of arbitrary code depending on the specific environment.

The ability to achieve remote code execution via a specially crafted file represents a significant threat to system integrity and confidentiality. Given the CVSS score of 9.8, this vulnerability is critical, as it allows attackers to bypass security controls and gain unauthorized control over systems processing firmware data. Successful exploitation could lead to full system compromise and long term persistence within the infrastructure.

Immediate Action: Update theopolis uefi-firmware-parser to version 1.14 or later to resolve the heap memory corruption vulnerability.

Proactive Monitoring: Monitor systems for unexpected service crashes or abnormal memory usage patterns when processing UEFI or BIOS firmware files.

Compensating Controls: Ensure that any software or automated pipelines utilizing this parser operate within a sandboxed environment with limited privileges to restrict the impact of potential code execution.

Public Exploit Available: Unknown

This vulnerability presents a high risk to all environments relying on the uefi-firmware-parser for firmware analysis. Administrators should prioritize the application of the 1.14 update across all affected systems immediately. Failure to patch may expose infrastructure to sophisticated attacks targeting firmware integrity.