CVE-2026-64200

DASYLab, NI's data-acquisition software, contains an out-of-bounds read (CWE-125) caused by improper validation of user-supplied data, which reads past the end of an allocated heap buffer during string conversion. An attacker triggers the flaw by convincing a user to open a specially crafted .DSB file, so exploitation requires local access and user interaction. Per the CVSS 4.0 score of 8.5, impacts are rated high for confidentiality, integrity, and availability, though out-of-bounds reads most commonly expose process memory or crash the application. All DASYLab versions before 2026.0.0 are affected, meaning any deployment not yet on the 2026.0.0 release is exposed to malicious files from untrusted sources. There is currently no known exploitation: the flaw is not in CISA's KEV, has no public proof-of-concept, and EPSS assigns just a 0.1% probability of exploitation in the next 30 days.

What to do: Upgrade to DASYLab 2026.0.0 or later, which resolves this issue. Until patched, do not open .DSB files received from untrusted or unverified sources, and check asset inventories for any DASYLab installations that may handle third-party or customer-supplied data files.