Executive brief
openFPGALoader is a utility used to program FPGA hardware chips. A security flaw allows a malicious actor to create a specially crafted configuration file (.pof) that, when opened by a user, causes the program to read sensitive information from the computer's memory or crash. This represents a supply-chain risk for developers who download and use FPGA project files from untrusted sources.
Technical details
A heap-buffer-overflow read vulnerability exists in POFParser::parseSection() within openFPGALoader versions up to and including 1.1.1. The root cause is a failure to validate a 32-bit size field read directly from a .pof file before passing it to std::copy. An attacker can provide a size value that exceeds the actual file buffer, leading to an out-of-bounds read from heap memory. This leaked data is stored in the internal bitstream buffer, potentially leading to information disclosure or a denial-of-service (crash). Exploitation requires a user to attempt to parse a malicious .pof file; no FPGA hardware is required to trigger the bug.
Affected products
- trabucayre openFPGALoader <= 1.1.1
Timeline
- 2026-04-01: advisory: GitHub Security Advisory published by vendor
- 2026-04-06: disclosed: CVE-2026-35176 published