Altera HLS Compiler CVE-2025-13669

Exploitation requires the attacker to already hold low-privileged local access and write access to a directory that appears in the DLL search order ahead of the legitimate library used by the Altera High Level Synthesis Compiler on Windows. A legitimate user must then actively launch the compiler for the malicious DLL to load (UI:A). Exploitation is further limited by local-only access (AV:L), high attack complexity (AC:H), a specific attack requirement (AT:P), and the need for existing low-level privileges (PR:L), which collectively make default, unattended exploitation impractical. Affected versions are 19.1 through 24.3.

This is a moderate, low-priority issue despite its HIGH confidentiality/integrity/availability impact flags. The CVSS 4.0 vector (AV:L/AC:H/AT:P/PR:L/UI:A) describes a locally-exploitable DLL search-order hijack that demands significant preconditions: local access, low-level privileges already held, high attack complexity, a specific attack requirement (AT:P), and active user interaction (a victim must launch the compiler). These preconditions sharply constrain real-world exploitability and are consistent with the medium 5.4 base score. The EPSS score of 0.12% (2nd percentile) confirms very low expected exploitation probability, and there is no CISA KEV listing and no public exploit identified, so no signals conflict - every indicator points the same direction: a genuine but low-urgency local vulnerability. CWE-427 (Uncontrolled Search Path Element) matches the 'Search Order Hijacking' description. One caveat: the input Tags label the impact as 'Information Disclosure,' but the CVSS vector sets VC/VI/VA all to HIGH (full code execution in the user's context), so the tag understates the true impact - treat this as a code-execution risk, not merely disclosure. Note the input provides only a CVSS 4.0 vector (no 3.1 vector), and no vendor-confirmed patch version is present in the supplied data beyond the advisory URL.

An attacker with low-privileged local access to an FPGA development workstation plants a malicious DLL in a directory that the Altera High Level Synthesis Compiler searches before the legitimate library location. When a developer later launches the compiler, the planted DLL is loaded and the attacker's code executes in the developer's security context. No public exploit code has been identified, and the high attack complexity plus required user interaction make opportunistic exploitation unlikely.