The vulnerability permits an attacker to alter the signed image metadata so that the bootloader ignores integrity checks on certain firmware components and loads replacements that were not signed, facilitating the deployment of malicious firmware during system startup.

Products impacted include the barebox bootloader from release 2016.03.0 up through 2026.03.0, as well as the backported 2025.09.3 build. Related U‑Boot releases from denx, such as the 2026.04 release candidates, and barebox images supplied by pengutronix are also affected.

Severity is high with a score of 8.3, and the likelihood of exploitation is low, noted as less than one percent. The flaw is not recorded in the known exploited vulnerabilities catalog. Exploitation would require the ability to construct or modify FIT images, typically through firmware modification or direct device access; the attack vector is therefore most likely local or physical.