Boot Logo to Bootkit: An Out-of-Bounds Write in U-Boot's RLE8 BMP Decoder
A crafted boot-splash BMP walks U-Boot's RLE8 decoder off the front of the framebuffer and writes attacker bytes into U-Boot's own image. On the SoCs that scan out from DRAM it becomes pre-OS code execution, decoded automatically before anything checks a signature.