The vulnerability is an out-of-bounds write within the BMP RLE8 bitmap decoder in the u‑boot bootloader. A maliciously crafted BMP image can corrupt memory adjacent to the framebuffer and cause the bootloader to crash. This denial‑of‑service behavior would halt the boot process, potentially immobilizing the device until a reboot or manual recovery is performed. The underlying weakness is reflected by CWE‑787 and is addressed exclusively by correcting the bounds check in the decoder function.

Denx u‑boot release versions through 2026.10‑rc5 are impacted. This includes all builds derived from the 2026.10‑rc5 tag and earlier, regardless of the specific board or platform. If a system is running any of those u‑boot versions, it is susceptible.

The CVSS score of 6 indicates medium severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed widespread exploitation yet. Attackers would need to supply the crafted BMP image during the boot sequence, which typically requires access to boot media such as a USB drive, SD card, or internal ROM image. This inference is drawn from the description that the exploit occurs when the bootloader processes a BMP image. Consequently, the risk is concentrated on devices that load BMP images automatically during boot or at an early stage of operation.