CVE-2026-35170: 
NixOS vulnerability analysis and mitigation

CVE-2026-35170 is a heap-buffer-overflow read vulnerability in BitParser::parseHeader() within openFPGALoader, a utility for programming FPGAs. It affects openFPGALoader version 1.1.1 and earlier (up to commit 3429d34), allowing out-of-bounds heap memory access when parsing a crafted .bit file. No FPGA hardware is required to trigger the vulnerability. It was published on April 6, 2026, with a CVSS v3.1 base score of 7.1 (High) (GitHub Advisory, Red Hat CVE).

The root cause is an out-of-bounds read (CWE-125) in src/bitparser.cpp. BitParser::parseHeader() reads a 16-bit big-endian length field from offset 0 of the input .bit file and uses it to advance a buffer index (pos_data) without any bounds checking — pos_data can jump up to 65,537 bytes, far beyond the actual file size. Because _raw_data is a std::string and operator[] does not perform bounds checking, subsequent reads occur on heap memory beyond the allocated buffer. A while(1) loop continues reading at attacker-controlled offsets with no exit condition other than finding a specific byte value (type == 'e'), amplifying the out-of-bounds traversal. A minimal 52-byte crafted .bit file with a 0xFFFF length field is sufficient to trigger the vulnerability (GitHub Advisory).

Successful exploitation results in information disclosure (high confidentiality impact) and application crash (high availability impact), with no integrity impact. An attacker can read arbitrary heap memory beyond the allocated buffer, potentially exposing sensitive data present in the process heap. This also represents a supply-chain risk: a malicious .bit file embedded in an FPGA project repository can trigger the vulnerability on any developer or engineer who loads it with openFPGALoader (GitHub Advisory).

A proof-of-concept exploit is publicly available in the GitHub Security Advisory, consisting of a Python script that generates a minimal 52-byte malicious .bit file and compilation/execution instructions that trigger AddressSanitizer-confirmed heap-buffer-overflow. Exploitation requires local access and user interaction (opening a crafted .bit file), but no privileges or FPGA hardware. There is no evidence of in-the-wild exploitation at this time, and the EPSS score is very low at 0.013% (GitHub Advisory). The vulnerability is not listed in the CISA KEV catalog.

1. Craft malicious .bit file: Use the following Python script to generate a 52-byte malicious .bit file with a 0xFFFF length field that will cause pos_data to advance 65,537 bytes beyond the buffer:

import struct, sys
data = struct.pack('>H', 0xFFFF)  # length = 65535
data += b'A' * 50
sys.stdout.buffer.write(data)

Run: python3 gen_poc.py > poc_bitparser.bit

2. Deliver the file: Place the crafted .bit file in an FPGA project repository, share it via a supply-chain vector, or deliver it directly to a target user who uses openFPGALoader.

3. Trigger parsing: The victim runs openFPGALoader against the crafted file (e.g., ./openFPGALoader -b <board> poc_bitparser.bit or via a PoC harness: ./poc_harness bit poc_bitparser.bit). BitParser::parseHeader() reads the 0xFFFF length field and advances pos_data by 65,537 bytes without bounds checking.

4. Out-of-bounds heap read: The while(1) loop continues reading heap memory at attacker-controlled offsets, disclosing heap contents and eventually causing a crash. With ASAN enabled, the output confirms: ERROR: AddressSanitizer: heap-buffer-overflow ... READ of size 1 at ... in BitParser::parseHeader() (GitHub Advisory).

• File System: Presence of anomalously small .bit files (e.g., ~52 bytes) in FPGA project directories; .bit files with a 0xFFFF or other large value as the first two bytes (big-endian 16-bit length field).
• Process: openFPGALoader process crashing unexpectedly or producing segmentation faults when loading .bit files; abnormal termination signals (SIGSEGV, SIGABRT) from the openFPGALoader process.
• Logs: Application crash logs or core dumps referencing BitParser::parseHeader() or src/bitparser.cpp:55; AddressSanitizer output containing heap-buffer-overflow in openFPGALoader context.

No patched release version has been officially published as of the advisory date (the advisory lists affected versions as <= 3429d34 with "Patched versions: None"). Users should avoid opening .bit files from untrusted or unverified sources. As a workaround, implement input validation and bounds checking before passing .bit files to openFPGALoader, and monitor the upstream repository for a patched release. Organizations should track the advisory at the GitHub Security Advisory page for patch availability (GitHub Advisory).

The vulnerability was reported by a researcher credited as "Sebasteuo" and disclosed via GitHub Security Advisories on April 1, 2026. Red Hat acknowledged the CVE on April 7, 2026. Coverage has been limited to automated vulnerability tracking services including VulDB, ENISA EUVD, and CVE reporting aggregators, with no notable broader media or researcher commentary identified (GitHub Advisory, Red Hat CVE).