barebox versions prior to 2026.04.0 contain multiple memory-safety vulnerabilities in the EFI PE loader component. These include an integer overflow during virtual image size calculation and improper validation of PE section data boundaries. Exploitation can occur by supplying a malicious EFI PE binary via TFTP, USB, SD card, or network boot, potentially leading to heap buffer overflow or out-of-bounds reads. This may allow code execution within the bootloader context.