The vulnerability is an integer overflow in the EFI PE loader's calculation of virtual image size, where 32‑bit arithmetic on section VirtualAddress and size values allows an undersized heap allocation. The loader also fails to verify that PointerToRawData plus the copied size remains inside the PE file buffer. As a result, an attacker supplying a crafted EFI PE binary can cause a heap buffer overflow or out‑of‑bounds read and potentially execute arbitrary code in the bootloader context.

The flaw affects barebox firmware versions prior to v2026.04.0. The affected vendor is barebox:barebox. Any installation of these legacy firmware images that can be booted from TFTP, USB, SD card, or over the network is subject to this weakness.

The CVSS score of 8.6 denotes high severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is feasible because a malicious EFI PE file can be delivered via common boot media such as TFTP, USB, SD card, or network boot. The impact, if exploited, is code execution at the bootloader level, which could compromise the entire system before the operating system loads.