Executive brief
DASYLab is a data acquisition and signal analysis software platform used for testing and measurement. An out-of-bounds write vulnerability in the DSB file parser allows attackers to execute arbitrary code by crafting a malicious file and tricking a user into opening it. The vulnerability requires user interaction but can result in complete compromise of the affected system.
Technical details
CVE-2026-64195 is a heap-based out-of-bounds write vulnerability (CWE-787) in DASYLab's DSB file parsing logic caused by insufficient validation of user-supplied data. The vulnerability is triggered when a user opens a specially crafted DSB file; exploitation requires local user interaction but does not require privilege escalation or authentication. An attacker can leverage this flaw to read sensitive data from memory (information disclosure) or execute arbitrary code with the privileges of the DASYLab process. The issue affects all DASYLab versions before 2026.0.0 (Build 65), which provides a patched version.
Affected products
- measX DASYLab all versions before 2026.0.0 (Build 65)
Timeline
- 2026-08-17: disclosed
- 2026-09-03: advisory
- 2026-09-03: patched: Fixed in DASYLab 2026.0.0 (Build 65)