CVE-2026-35170 is a heap-buffer-overflow read vulnerability (CWE-125) in the openFPGALoader utility, specifically in the BitParser::parseHeader() function. When parsing a maliciously crafted .bit file, the software may read beyond allocated heap memory boundaries, potentially exposing sensitive data or causing a denial of service. The vulnerability affects openFPGALoader versions up to and including 1.1.1. No FPGA hardware is required to trigger this issue. The CVSS 3.1 base score is 7.1, reflecting a high severity with local attack vector, low attack complexity, no privileges required, user interaction needed, unchanged scope, high confidentiality impact, no integrity impact, and high availability impact.

Successful exploitation can lead to unauthorized disclosure of heap memory contents (confidentiality impact) and cause application crashes or denial of service (availability impact). There is no indication of integrity impact. The vulnerability can be triggered locally by a user supplying a crafted .bit file to the openFPGALoader utility. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid processing untrusted or malformed .bit files with openFPGALoader versions 1.1.1 and earlier. Monitor the vendor's channels for updates regarding patches or mitigations.