CVE-2026-35170

openFPGALoader versions 1.1.1 and earlier contain a heap-buffer-overflow read vulnerability in the BitParser::parseHeader() function that allows attackers to access out-of-bounds heap memory when parsing a maliciously crafted .bit file. This vulnerability affects the FPGA programming utility and notably does not require physical FPGA hardware to be triggered, expanding the potential attack surface. The vulnerability has been assigned a CVSS score of 7.1 (HIGH) with a local attack vector requiring only user interaction and no special privileges, resulting in high confidentiality and availability impact. Exploitation status indicates this vulnerability is not currently listed on the CISA KEV catalog and shows no evidence of active exploitation, with an extremely low EPSS score of 0.00014 suggesting minimal real-world threat activity. Organizations using openFPGALoader should prioritize patching to versions after 1.1.1, though the low FAUCET risk score of 37.0/100 and inactive status on threat tracking lists indicate this is not an immediately critical threat requiring emergency response.