openFPGALoader, a utility for programming FPGAs, contains a heap-buffer-overflow read vulnerability (CWE-125) in the BitParser::parseHeader() function in versions 1.1.1 and earlier. This vulnerability allows out-of-bounds heap memory access when parsing specially crafted .bit files. The issue does not require FPGA hardware to be triggered, indicating the vulnerability lies in the file parsing logic itself. The CVSS 3.1 score is 7.1, reflecting high severity with local attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, high confidentiality impact, no integrity impact, and high availability impact. No patch or official remediation guidance is currently available from the vendor or project.

Successful exploitation of this vulnerability could lead to out-of-bounds heap reads, potentially causing application crashes or denial of service conditions. Confidentiality impact is rated high, indicating possible exposure of sensitive memory contents. Integrity impact is not affected, but availability impact is high due to potential crashes. No known exploits have been reported in the wild to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid processing untrusted or crafted .bit files with openFPGALoader versions 1.1.1 and earlier. Monitor the official trabucayre openFPGALoader project for updates and patches addressing this vulnerability.