CVE-2026-35176 is a heap-buffer-overflow read vulnerability in openFPGALoader (<= 1.1.1), specifically in the POFParser::parseSection() function. When processing a crafted .pof file, the parser can read beyond the allocated heap buffer, leading to out-of-bounds memory access. This vulnerability can be triggered without requiring FPGA hardware, potentially impacting systems that use openFPGALoader for FPGA programming. The CVSS 3.1 base score is 7.1, reflecting a high severity due to local attack vector with low complexity, no privileges required, user interaction needed, and high confidentiality and availability impact.

Successful exploitation can lead to unauthorized reading of heap memory beyond intended boundaries, potentially exposing sensitive information (confidentiality impact) and causing denial of service (availability impact). Integrity impact is not indicated. The vulnerability requires local access and user interaction to exploit. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, avoid processing untrusted or malicious .pof files with openFPGALoader versions 1.1.1 and earlier. Monitor vendor channels for updates and apply patches promptly once available.