CVE-2026-64199

DASYLab, NI's (National Instruments, now part of Emerson) data-acquisition and analysis software, contains an out-of-bounds read vulnerability (CWE-125) caused by improper validation of user-supplied data, allowing a read beyond the bounds of an allocated data structure. Exploitation requires a user to open a specially crafted .DSB worksheet file, making this a local, user-assisted attack rather than a network-service flaw. A successful attacker could read memory outside the intended buffer, potentially exposing sensitive process data or crashing the application; NI rates the potential impact high at CVSS 4.0 8.6. All DASYLab versions before 2026.0.0 are affected. There is currently no known exploitation, no public proof-of-concept, and a low EPSS score (0.1% probability of exploitation in 30 days); the flaw is not in CISA KEV.

What to do: Upgrade DASYLab to version 2026.0.0 or later. Until upgraded, do not open .DSB worksheet files from untrusted or unsolicited sources, as exploitation depends entirely on opening a malicious file. Inventory engineering, QA, and lab workstations for DASYLab installations to determine whether they are in scope.