CVE-2026-35176 is a heap-buffer-overflow read vulnerability (CWE-125) in openFPGALoader (<= 1.1.1) within the POFParser::parseSection() function. When processing a crafted .pof file, the software may access heap memory out-of-bounds, potentially leading to information disclosure and denial of service. The vulnerability can be triggered without requiring FPGA hardware. The CVSS 3.1 base score is 7.1 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H), reflecting local attack vector, low complexity, no privileges required, user interaction needed, unchanged scope, high confidentiality impact, no integrity impact, and high availability impact. No patch or official remediation is currently documented.

Successful exploitation can lead to out-of-bounds heap reads, which may disclose sensitive information and cause application crashes resulting in denial of service. The confidentiality and availability impacts are rated high. No integrity impact is indicated. The vulnerability requires local access and user interaction to trigger.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, avoid processing untrusted or malformed .pof files with openFPGALoader versions 1.1.1 and earlier. Monitor vendor channels for updates and apply patches promptly once available.