CVE-2026-64195

DASYLab, NI's (National Instruments/Emerson) data acquisition software, contains an out-of-bounds write flaw caused by insufficient validation of user-supplied data when parsing files. An attacker triggers the issue by convincing a user to open a specially crafted .DSB file, and the memory corruption could allow arbitrary code execution with the privileges of that user. All DASYLab versions prior to 2026.0.0 are affected. Users running older releases, typically engineers on workstations that import measurement files from external sources, are exposed to this social-engineering-driven attack. As of now there is no known public proof of concept, the flaw is not in CISA's KEV catalog, and EPSS estimates only a 0.1% chance of exploitation in the next 30 days.

What to do: Upgrade DASYLab to version 2026.0.0 or later, which fixes this issue. Until patched, do not open .DSB files from untrusted or unknown sources, and check whether any engineering or lab workstations in your environment run DASYLab versions prior to 2026.0.0.