Is uefi-firmware affected by GHSA-2689-5p89-6j3j?

PyPI uefi-firmware is affected in <=1.12.

Is GHSA-2689-5p89-6j3j being exploited?

Not on the CISA KEV list. EPSS exploit probability is not available.

critical

GHSA-2689-5p89-6j3j

Q: Is GHSA-2689-5p89-6j3j being exploited?

Not on the CISA KEV list. EPSS exploit probability is not available.

PyPI · uefi-firmware

Summary

UEFI Firmware Parser has a stack out-of-bounds write in tiano decompressor MakeTable

Severity: critical
Published: 2026-04-16

References

https://github.com/theopolis/uefi-firmware-parser/security/advisories/GHSA-2689-5p89-6j3j
https://github.com/theopolis/uefi-firmware-parser/pull/145
https://github.com/theopolis/uefi-firmware-parser/commit/bf3dfaa8a05675bae6ea0cbfa082ddcebfcde23e

Related advisories

GHSA-hm2w-vr2p-hq7w — critical · PyPI/uefi-firmware

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Check my repo

Summarize with AI

ChatGPT Claude Perplexity

Sources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.