openFPGALoader, a command‑line tool for programming FPGAs, contains a heap‑buffer‑overflow read in the POFParser::parseSection() routine. When it parses a specially crafted .pof file, the parser accesses memory beyond the bounds of an allocated buffer. The vulnerability does not require any FPGA hardware to trigger and can simply be exercised by running the utility against a maliciously crafted file. The out‑of‑bounds read may expose sensitive data that resides on the heap, potentially leading to information disclosure or, if the heap is overwritten, a crash or other downstream failures.

The flaw affects trabucayre:openFPGALoader versions 1.1.1 and earlier. Upgrading to any release newer than 1.1.1 removes the vulnerable code path. No other vendor or product is directly impacted by this issue.

The CVSS base score of 7.1 indicates a high‑risk flaw. No exploit probability was reported and the vulnerability is not listed in CISA’s KEV catalog. Because the attack only requires a crafted .pof file and can be exercised locally by anyone who can run openFPGALoader, the attack vector is inferred to be local or remote code running on the same system. An attacker could obtain confidential data from the process’s memory or cause denial of service by crashing the program.