CVE-2026-64197

NI DASYLab contains an out-of-bounds write (CWE-787) caused by improper validation of user-supplied data, allowing a write past the end of an allocated data structure. An attacker must convince a user to open a specially crafted .DSB file, typically via email or a shared drive, to trigger the flaw. Successful exploitation could compromise the local system with high impact to confidentiality, integrity, and availability (CVSS 4.0 score 8.5), since the code runs with the user's privileges. All DASYLab versions prior to 2026.0.0 are affected, meaning virtually every deployed installation except the newest release is in scope. There is no evidence of exploitation so far: the flaw is not in CISA's KEV, EPSS assigns it only a 0.1% probability of exploitation in the next 30 days, and no public proof-of-concept is known.

What to do: Upgrade to DASYLab 2026.0.0 or later, which fixes this issue. Until patched, avoid opening .DSB files from untrusted or unknown sources and inventory workstations running DASYLab, prioritizing systems that routinely receive data files from external parties. Because exploitation requires user interaction, user awareness about opening unsolicited data-acquisition files is the primary interim mitigation.