Openfpgaloader CVE-2026-35176

openFPGALoader is an open-source utility developed by trabucayre for programming various FPGA devices from manufacturers like Intel/Altera, Xilinx, and Lattice. The vulnerability resides in the POFParser::parseSection() function which handles Programmer Object File (.pof) format used primarily for Altera/Intel FPGAs. The CWE-125 classification identifies this as an out-of-bounds read vulnerability where the parser attempts to access heap memory beyond allocated buffer boundaries when processing section data in malformed .pof files. Because .pof files are external input processed before hardware interaction, attackers can trigger the overflow purely through file parsing logic without needing physical FPGA devices connected to the target system. The local attack vector (AV:L) and user interaction requirement (UI:R) indicate exploitation requires convincing a user to open a weaponized bitstream file with the vulnerable openFPGALoader version.