CVE-2026-64196

NI DASYLab contains an out-of-bounds write vulnerability (CWE-787) caused by improper validation of user-supplied data, allowing a write past the end of an allocated heap buffer when the application parses a DASYLab data file. An attacker exploits it by convincing a user to open a specially crafted .DSB file; because the CVSS 4.0 impact metrics rate confidentiality, integrity, and availability as high, successful exploitation could plausibly allow arbitrary code execution in the context of the DASYLab user. All DASYLab versions prior to 2026.0.0 are affected, meaning essentially any deployed copy of the product on lab or test workstations is vulnerable until patched. There is currently no public proof-of-concept, the flaw is not in CISA's KEV catalog, and EPSS assigns only a 0.1% probability of exploitation in the next 30 days, so no active exploitation is known.

What to do: Upgrade DASYLab to version 2026.0.0 or later, which is the first release with this flaw fixed. Until patched, do not open .DSB files from untrusted or unsolicited sources on workstations running DASYLab, and inventory lab and test-bench machines for DASYLab installs to prioritize remediation.