An integer overflow vulnerability in the barebox bootloader (prior to 2026.04.0) poses a significant risk of system compromise or crash.

This is an integer overflow (CWE-190) occurring within the EFI PE loader. The vulnerability is exploitable by an unauthenticated attacker, as indicated by the CVSS vector (PR:N).

Successful exploitation allows an attacker to achieve high levels of impact on the target device, potentially leading to full system compromise or a denial-of-service condition. Given the CVSS score of 8.4, this vulnerability is categorized as high severity and requires immediate attention to prevent unauthorized code execution at the boot level.

Immediate Action: Update barebox to version 2026.04.0 or later as provided in the official repository.

Proactive Monitoring: Monitor boot logs and system integrity metrics for unexpected crashes or errors during the initialization phase.

Compensating Controls: Ensure that physical access to hardware is restricted and that secure boot mechanisms are correctly configured to prevent unauthorized bootloader modifications.

Public Exploit Available: No (exploit_available: false)

The severity of this flaw necessitates a high-priority patching cycle for all systems utilizing the barebox bootloader. Organizations should verify their current firmware version and apply the update to 2026.04.0 immediately to mitigate the risk of memory-related exploitation.