Is CVE-2026-64195 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-64195 being exploited in the wild.

How severe is CVE-2026-64195?

High severity, with a CVSS score of 7.8, published 3 September 2026.

Which products and versions are affected?

measX DASYLab all versions before 2026.0.0 (Build 65).

Is there a fix for CVE-2026-64195?

A patch was published on 2026-09-03: Fixed in DASYLab 2026.0.0 (Build 65) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-64195 attacked?

It is attacked with local access.

Am I affected by CVE-2026-64195?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-64195: measX DASYLab out-of-bounds write in DSB file parsing

CVE-2026-64195 · Severity: high · CVSS 7.8 · Published 2026-09-03

DASYLab is a data acquisition and signal analysis software platform used for testing and measurement. An out-of-bounds write vulnerability in the DSB file parser allows attackers to execute arbitrary code by crafting a malicious file and tricking a user into opening it. The vulnerability requires user interaction but can result in complete compromise of the affected system.

Quick answers

Is CVE-2026-64195 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-64195 being exploited in the wild.
How severe is CVE-2026-64195?: High severity, with a CVSS score of 7.8, published 3 September 2026.
Which products and versions are affected?: measX DASYLab all versions before 2026.0.0 (Build 65).
Is there a fix for CVE-2026-64195?: A patch was published on 2026-09-03: Fixed in DASYLab 2026.0.0 (Build 65) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-64195 attacked?: It is attacked with local access.
Am I affected by CVE-2026-64195?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

CVE-2026-64195 is a heap-based out-of-bounds write vulnerability (CWE-787) in DASYLab's DSB file parsing logic caused by insufficient validation of user-supplied data. The vulnerability is triggered when a user opens a specially crafted DSB file; exploitation requires local user interaction but does not require privilege escalation or authentication. An attacker can leverage this flaw to read sensitive data from memory (information disclosure) or execute arbitrary code with the privileges of the DASYLab process. The issue affects all DASYLab versions before 2026.0.0 (Build 65), which provides a patched version.

Affected products

measX DASYLab all versions before 2026.0.0 (Build 65)

Timeline

2026-08-17: disclosed
2026-09-03: advisory
2026-09-03: patched: Fixed in DASYLab 2026.0.0 (Build 65)

References

https://www.measx.com/en/service/productsecurity/security-updates-for-measx-software/159-securityupdates/1071-out-of-bounds-write-vulnerabilities-in-dasylab-2.html

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.