CVE-2026-35176

HighCVSS 7.1

Published: 06/04/2026(UTC)Updated: 20/07/2026(UTC)Translated: 21/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.16%

6th percentile - higher than 6% of all known CVEs

Summary

In openFPGALoader version 1.1.1 and earlier, a heap-buffer-overflow read vulnerability exists in POFParser::parseSection() that allows out-of-bounds heap memory access when parsing a crafted .pof file. No FPGA hardware is required to trigger this vulnerability.

Risk Assessment

The risk involves potential remote code execution or sensitive data disclosure by supplying a malicious .pof file. The vulnerability could lead to application crashes or potential system compromise.

Recommendation

It is recommended to immediately update openFPGALoader to the latest patched version. Avoid opening .pof files from untrusted sources until the update is applied.

Other vulnerabilities in openFPGALoader

CVE-2026-35170High
In openFPGALoader version 1.1.1 and earlier, a heap-buffer-overflow read vulnerability exists in BitParser::parseHeader() that allows out-of-bounds heap memory access when parsing a crafted .bit file. No FPGA hardware is required to trigger this vulnerability.

Original NVD description (English source)

openFPGALoader is a utility for programming FPGAs. In 1.1.1 and earlier, a heap-buffer-overflow read vulnerability exists in POFParser::parseSection() that allows out-of-bounds heap memory access when parsing a crafted .pof file. No FPGA hardware is required to trigger this vulnerability.