openFPGALoader, a tool for programming FPGAs, contains a heap‑buffer‑overflow read in BitParser::parseHeader(). When the program parses a specially crafted .bit file, it can read memory beyond intended bounds. The flaw is a read‑only out‑of‑bounds access; the description does not indicate code execution, but the vulnerability could allow an attacker to reveal sensitive memory contents.

The vulnerability affects the trabucayre openFPGALoader utility. Versions 1.1.1 and prior are impacted. Any system running those versions, regardless of whether FPGA hardware is connected, is susceptible to the flaw because the heap read occurs during file parsing.

The CVSS score of 7.1 suggests moderate‑to‑high risk. EPSS data is not available, and the vulnerability is not yet listed in the CISA KEV catalog. The likely attack vector is local or remote file‑processing; an attacker who can supply a malicious .bit file to the vulnerable program can trigger the out‑of‑bounds read. No specific hardware or additional conditions are required to exploit the flaw. The impact is primarily information disclosure of arbitrary heap data, potentially leading to further attacks if the information is valuable.