CVE-2026-35170CWE-125

openFPGALoader has a heap buffer overflow in BitParser::parseHeader() via crafted .bit file

High · published April 6, 2026

CVSS v3.1
7.1
EPSS
0%
Percentile
6.1
In the wild
Unconfirmed
What it is

openFPGALoader is a utility for programming FPGAs. In 1.1.1 and earlier, a heap-buffer-overflow read vulnerability exists in BitParser::parseHeader() that allows out-of-bounds heap memory access when parsing a crafted .bit file. No FPGA hardware is required to trigger this vulnerability.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00170 · 6.1th percentile
Weakness
CWE-125 · Out-of-bounds Read
Published
2026-04-06T18:59Z
EPSS history
Timeline
  • 06 APR 18:59Z
    openFPGALoader has a heap buffer overflow in BitParser::parseHeader() via crafted .bit file
    cvelistv5