lattice semiconductor vulnerabilities

Products

• ispVM System 1
• lattice diamond programmer 1
• pac-designer 1

Latest lattice semiconductor CVEs

Newest publication first

1. CVE-2012-10057 Lattice Semiconductor ispVM System 18.0.2 XCF File Handling Buffer Overflow

   Published 2025-08-13

   High·CVSS 8.4 EPSS 0.55% Framework module

   Lattice Semiconductor ispVM System v18.0.2 contains a buffer overflow vulnerability in its handling of .xcf project files. When parsing the version attribute of the ispXCF XML tag, the application fails to properly validate input length, allowing a specially crafted file to overw...

2. CVE-2012-2614 Buffer overflow in programmer.exe in Lattice Diamond Programmer 1.4.2 allows user-assisted remote attackers to cause a denial of service (application crash) and execute arbitrary code via a long strin...

   Published 2012-07-12

   Medium·CVSS 6.8 EPSS 4.1% PoC

   Buffer overflow in programmer.exe in Lattice Diamond Programmer 1.4.2 allows user-assisted remote attackers to cause a denial of service (application crash) and execute arbitrary code via a long string in a version attribute of an ispXCF element in an .xcf file.

3. CVE-2012-2915 Stack-based buffer overflow in Lattice Semiconductor PAC-Designer 6.2.1344 allows remote attackers to execute arbitrary code via a long string in a Value tag in a SymbolicSchematicData definition tag....

   Published 2012-05-21

   High·CVSS 9.3 EPSS 29.2% Framework module Public exploit

   Stack-based buffer overflow in Lattice Semiconductor PAC-Designer 6.2.1344 allows remote attackers to execute arbitrary code via a long string in a Value tag in a SymbolicSchematicData definition tag in PAC Design (.pac) file.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.