Executive brief
openFPGALoader is a utility used to program FPGA hardware chips. A security vulnerability allows a malicious actor to create a specially crafted configuration file (.bit) that, when opened by a user, can cause the application to crash or potentially expose sensitive information from the computer's memory. This represents a supply-chain risk for developers who download and use FPGA project files from untrusted sources.
Technical details
A heap-based out-of-bounds read vulnerability exists in the BitParser::parseHeader() function within src/bitparser.cpp. The root cause is a failure to perform bounds checking on a 16-bit big-endian length field read from the start of a .bit file; this length is used to increment a buffer index (pos_data) that subsequently accesses a std::string buffer. An attacker can provide a crafted .bit file with a large length value that exceeds the actual file size, leading to an out-of-bounds read when the parser attempts to read the next header segment. This can result in information disclosure of heap memory or a denial-of-service (crash). The vulnerability is triggered locally when a user attempts to parse a malicious file; no FPGA hardware is required for exploitation.
Affected products
- trabucayre openFPGALoader <= 1.1.1
Timeline
- 2026-04-01: advisory: GitHub Security Advisory published
- 2026-04-06: disclosed: CVE published to NVD