CVE-2026-35176
Published: 06 April 2026
Summary
CVE-2026-35176 is a high-severity Out-of-bounds Read (CWE-125) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Malicious File (T1204.002); ranked at the 3.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the heap-buffer-overflow vulnerability by identifying, reporting, and patching the flaw in openFPGALoader's POFParser::parseSection() function.
Enforces validation of .pof file inputs to prevent out-of-bounds heap memory access during parsing of crafted files.
Implements memory safeguards like address space randomization to mitigate exploitation of the heap buffer overflow read vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is directly triggered by a user processing a malicious .pof file with openFPGALoader (T1204.002 Malicious File), and the out-of-bounds read enables application crashes for denial of service (T1499.004 Application or System Exploitation).
NVD Description
openFPGALoader is a utility for programming FPGAs. In 1.1.1 and earlier, a heap-buffer-overflow read vulnerability exists in POFParser::parseSection() that allows out-of-bounds heap memory access when parsing a crafted .pof file. No FPGA hardware is required to trigger this vulnerability.
Deeper analysisAI
CVE-2026-35176 is a heap-buffer-overflow read vulnerability in the POFParser::parseSection() function of openFPGALoader, an open-source utility for programming FPGAs. The issue affects versions 1.1.1 and earlier, enabling out-of-bounds heap memory access when the tool parses a specially crafted .pof file. No FPGA hardware is required to trigger the vulnerability, making it exploitable solely through software input processing.
The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H), classified under CWE-125 (Out-of-bounds Read). A local attacker with no privileges can exploit it by convincing a user to process a malicious .pof file using openFPGALoader. This requires user interaction but low complexity, potentially allowing the attacker to disclose sensitive heap memory contents for high confidentiality impact and cause application crashes for high availability impact.
Mitigation details are available in the project's GitHub security advisory at https://github.com/trabucayre/openFPGALoader/security/advisories/GHSA-9x7m-m8gv-px2j.
Details
- CWE(s)