CVE-2026-35176: 
NixOS vulnerability analysis and mitigation

CVE-2026-35176 is a heap-buffer-overflow read vulnerability in openFPGALoader's POFParser::parseSection() function that allows out-of-bounds heap memory access when parsing a crafted .pof file. It affects openFPGALoader versions 1.1.1 and earlier (up to commit 3429d34). No FPGA hardware is required to trigger the vulnerability. It was published on April 6, 2026, with a CVSS v3.1 base score of 7.1 (High) (GitHub Advisory, Red Hat CVE).

The root cause is an out-of-bounds read (CWE-125) in src/pofParser.cpp. In POFParser::parse(), a 32-bit size field is read directly from the .pof file and passed to parseSection() without validating that pos + size does not exceed the file buffer length. In parseSection(), case 0x11 uses this attacker-controlled size to resize _bit_data and then calls std::copy(_raw_data.begin() + pos, _raw_data.begin() + pos + size, _bit_data.begin()) — when pos + size exceeds _raw_data.size(), the copy reads heap memory beyond the allocated buffer. An additional issue exists in the ARRAY2INT32 macro in pofParser.hpp, which casts values to uint16_t before left-shifting by 16 and 24 bits, constituting undefined behavior under the C++ standard. Exploitation requires only that a victim opens a malicious .pof file with the tool (GitHub Advisory).

Successful exploitation can result in information disclosure and application crash (denial of service). The leaked heap memory is stored in _bit_data, which may subsequently be written to an FPGA device or to a file, potentially exposing sensitive in-memory data. This represents a supply-chain risk when malicious .pof files are distributed within FPGA development projects or shared repositories (GitHub Advisory).

A proof-of-concept exploit is publicly available in the GitHub Security Advisory, consisting of a minimal 50-byte Python script that generates a malicious .pof file reproducing the AddressSanitizer crash. The exploit requires local access and user interaction (opening the crafted file), but no privileges or FPGA hardware. The EPSS score is approximately 0.013% (very low probability of widespread exploitation), and there is no evidence of in-the-wild exploitation or CISA KEV catalog listing at this time (GitHub Advisory).

1. Craft malicious .pof file: Use the published Python PoC to generate a minimal 50-byte .pof file with a crafted size field that causes pos + size to exceed the actual file buffer length:

import struct, sys
data = b'POF\x00'
data += struct.pack('<I', 0x11)  # section flag
data += struct.pack('<I', 0xFFFFFFFF)  # oversized size field
data += b'\x00' * 42  # padding
with open('malicious.pof', 'wb') as f:
    f.write(data)

2. Deliver the file: Share the crafted .pof file via a project repository, email, or other distribution channel targeting an FPGA developer who uses openFPGALoader.
3. Trigger parsing: The victim runs openFPGALoader with the malicious file as input (e.g., openFPGALoader -b <board> malicious.pof), causing POFParser::parse() to read the oversized size field and pass it to parseSection().
4. Out-of-bounds read occurs: std::copy reads heap memory beyond the file buffer into _bit_data, potentially leaking sensitive heap contents and/or crashing the application with a segmentation fault or AddressSanitizer error (GitHub Advisory).

• File System: Unexpected or externally sourced .pof files in FPGA project directories, particularly those with anomalously small file sizes (e.g., ~50 bytes) but large declared section sizes.
• Process: openFPGALoader process terminating abnormally with a segmentation fault or memory error when processing a .pof file; crash dumps or core files generated by the openFPGALoader process.
• Logs: Application crash logs or AddressSanitizer output referencing POFParser::parseSection() or pofParser.cpp:164; system logs showing abnormal termination of the openFPGALoader binary.
• File System: Unexpected output files written by openFPGALoader containing anomalous binary data (potential heap memory leak stored in _bit_data) (GitHub Advisory).

No patched release version has been formally published as of the advisory date; the affected versions are listed as all commits up to and including 3429d34. Users should update to a commit beyond 3429d34 once a fix is merged, or build from the latest main branch after confirming the patch is applied. As a workaround, avoid opening .pof files from untrusted or unverified sources, and restrict openFPGALoader usage to authorized users with access only to trusted FPGA configuration files (GitHub Advisory).