CVE-2026-35170 trabucayre CVE debrief

Who should care

Users of openFPGALoader 1.1.1 and earlier should apply patches or mitigations to prevent potential out-of-bounds memory access. System administrators and security teams responsible for openFPGALoader deployments should review and implement vendor guidance. Vulnerability management and security teams should prioritize patching or mitigating affected systems.

Technical summary

The vulnerability is caused by improper parsing of .bit files in openFPGALoader, leading to a heap-buffer-overflow read. This can be exploited without FPGA hardware present. The vulnerability affects openFPGALoader versions 1.1.1 and earlier. The CVSS score of 7.1 indicates a high severity vulnerability. The vulnerability allows for out-of-bounds heap memory access. Users of openFPGALoader 1.1.1 and earlier should apply patches or mitigations to prevent potential out-of-bounds memory access. System administrators and security teams responsible for openFPGALoader deployments should review and implement vendor guidance. Vulnerability management and security teams should prioritize patching or mitigating affected systems. Additional verification steps are recommended to ensure system security and confirm whether affected product deployments exist in managed environments.

Defensive priority

High priority due to high CVSS score of 7.1 and potential for memory access exploitation.

Recommended defensive actions

• Apply patches or updates from the vendor
• Restrict access to .bit file parsing
• Monitor for suspicious .bit file activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD detail provide information on the vulnerability. The vendor advisory on GitHub offers mitigation guidance. Evidence is limited to public sources and may not reflect the full scope or impact of the vulnerability. Defenders should verify affected systems and apply patches or mitigations. Additional verification steps are recommended to ensure system security.

Official resources