CVE-2026-3407: YosysHQ Yosys Buffer Overflow Vulnerability

CVE-2026-3407 Overview

A heap-based buffer overflow vulnerability has been identified in YosysHQ Yosys, an open-source framework for Verilog RTL synthesis. The vulnerability exists in the Yosys::RTLIL::Const::set function within the kernel/rtlil.h file, specifically affecting the BLIF File Parser component. When processing maliciously crafted BLIF files, the application fails to properly validate buffer boundaries, resulting in a heap-based buffer overflow condition that could lead to denial of service or potential memory corruption.

Critical Impact

This heap-based buffer overflow vulnerability in the Yosys synthesis framework could allow a local attacker to cause application crashes or corrupt heap memory through maliciously crafted BLIF files.

Affected Products

• YosysHQ Yosys up to version 0.62
• Systems utilizing the BLIF File Parser component
• Environments processing untrusted BLIF synthesis files

Discovery Timeline

• 2026-03-02 - CVE-2026-3407 published to NVD
• 2026-03-02 - Last updated in NVD database

Technical Details for CVE-2026-3407

Vulnerability Analysis

The vulnerability resides in the Yosys::RTLIL::Const::set function located in kernel/rtlil.h. This function is responsible for handling constant value assignments within the Register Transfer Level Intermediate Language (RTLIL) implementation. When the BLIF File Parser processes input data, insufficient bounds checking in the set function allows memory writes beyond the allocated heap buffer boundaries.

The vulnerability is classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), which encompasses buffer overflow conditions where data is written outside the intended memory bounds. The attack requires local access to the system and the ability to provide a malicious BLIF file to the Yosys synthesis tool for processing. Notably, the vulnerability exhibits intermittent reproducibility, suggesting it may be dependent on specific memory layout conditions or input characteristics.

Root Cause

The root cause stems from improper boundary validation in the Yosys::RTLIL::Const::set function when handling data from BLIF file parsing operations. The function does not adequately verify that the index or size parameters fall within the allocated buffer bounds before performing memory write operations. This missing validation allows specially crafted BLIF files to trigger out-of-bounds heap memory access.

Attack Vector

The attack vector is local in nature, requiring an attacker to have the ability to provide malicious input files to the Yosys synthesis tool. An attacker could craft a malformed BLIF file containing specific data structures designed to trigger the buffer overflow condition when processed by the vulnerable parser component.

The exploitation scenario involves:

1. Creating a specially crafted BLIF file with malicious constant value definitions
2. Having the Yosys tool process the malicious file through normal synthesis operations
3. The BLIF File Parser invokes the vulnerable Yosys::RTLIL::Const::set function
4. Heap memory corruption occurs due to out-of-bounds write operations

The vulnerability has been publicly disclosed with proof-of-concept details available in the GitHub PoC Repository. Technical discussion and issue tracking can be found in GitHub Issue #5677.

Detection Methods for CVE-2026-3407

Indicators of Compromise

• Unexpected crashes or segmentation faults when Yosys processes BLIF files
• Heap corruption errors or memory allocation failures during synthesis operations
• Unusual memory consumption patterns when parsing BLIF input files
• Core dumps generated by the Yosys process containing heap overflow signatures

Detection Strategies

• Monitor Yosys process execution for abnormal termination or crash events during BLIF file processing
• Implement file integrity monitoring on BLIF files provided from untrusted sources
• Deploy AddressSanitizer (ASan) builds in development environments to detect heap overflow conditions
• Review system logs for repeated Yosys crashes that may indicate exploitation attempts

Monitoring Recommendations

• Enable crash reporting and analysis for Yosys synthesis processes in production environments
• Implement input validation for BLIF files before processing through the synthesis pipeline
• Monitor heap memory usage patterns for anomalies during Yosys execution
• Configure security tools to alert on memory corruption indicators from EDA tools

How to Mitigate CVE-2026-3407

Immediate Actions Required

• Update YosysHQ Yosys to a patched version that addresses the heap buffer overflow
• Restrict Yosys processing to trusted BLIF files from verified sources only
• Implement sandboxing or containerization for Yosys synthesis operations
• Review and validate all BLIF files from external sources before processing

Patch Information

The YosysHQ development team has addressed this vulnerability through official patches. Two pull requests have been submitted to fix the issue:

• GitHub Pull Request #5680 - Initial fix for the buffer overflow
• GitHub Pull Request #5681 - Additional remediation

Users should update to the latest version of Yosys that incorporates these fixes. The official GitHub Repository for Yosys contains the patched source code and release information.

Workarounds

• Run Yosys in isolated environments with limited system access and resource constraints
• Implement input sanitization by validating BLIF file structure before processing
• Use memory-safe compilation options such as AddressSanitizer for development builds
• Restrict user permissions for Yosys execution to minimize potential impact

# Configuration example
# Run Yosys with memory limits and isolation
ulimit -v 4194304  # Limit virtual memory to 4GB
ulimit -d 2097152  # Limit data segment size to 2GB

# Use containerized execution for untrusted inputs
docker run --memory=4g --cpus=2 --read-only \
  -v /path/to/input:/input:ro \
  -v /path/to/output:/output \
  yosyshq/yosys yosys -p "read_blif /input/design.blif"