The vulnerability is an out‑of‑bounds write in the RegularExpressionDxe/Oniguruma modules of CloverBootloader, specifically within the regcomp.C runtime routine. The flaw can overwrite adjacent memory locations, potentially corrupting control data and causing the boot process to crash or behave unpredictably. The advisory does not state that code execution can be achieved, so any claim beyond memory corruption would be speculative.

The issue exists in CloverHackyColor CloverBootloader releases before build 5162. Systems using those early builds remain vulnerable; builds from 5162 onward include the fix and are not affected.

The CVSS score is 5.1, indicating moderate severity, while the EPSS score is below 1%, showing a very low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Exploitation would likely require delivering a crafted firmware image or modified bootloader to the system, representing a local or pre‑boot attack vector. Given the moderate severity and low likelihood of exploitation, administrators should prioritize applying the patch and monitor boot environments for abnormal activity.