coreboot has a rather fragile JPEG parser for splash screens but the saving grace is that barely anybody uses it because that's normally the payload's job (the

coreboot has a rather fragile JPEG parser for splash screens but the saving grace is that barely anybody uses it because that's normally the payload's job (the jpeg + display thing was mostly added for a proof of concept "look how fast we can boot" demo in 2005) With payloads, some are more at risk than others. edk2 might run into issues here, grub2 has tons of features where stuff like this might hide in, other payloads (e.g. ChromeOS' depthcharge) are more limited in their functionality and therefore in their attack surface, too.