Executive brief
DASYLab is a data acquisition and signal analysis software platform used by engineers for measurement and test applications. This vulnerability allows attackers to execute arbitrary code on a victim's computer if they trick a user into opening a malicious DSB project file. The vulnerability stems from insufficient validation of file data, allowing memory corruption that can lead to system compromise or data theft.
Technical details
CVE-2026-64197 is an out-of-bounds write vulnerability (CWE-787) in DASYLab's DSB file parser. The vulnerability exists due to improper validation of user-supplied data in DSB files, resulting in a write past the end of an allocated data structure in heap memory. Exploitation requires a user to open a specially crafted DSB file—no authentication, network access, or elevated privileges are required. A successful attack allows arbitrary code execution in the context of the current process with user-level privileges. The vulnerability affects all DASYLab versions before 2026.0.0 (Build 65), and measX has released a patch in DASYLab 2026.0.0 (Build 65).
Affected products
- measX DASYLab all versions before 2026.0.0 (Build 65)
Timeline
- 2026-08-17: disclosed: Security advisory published by measX
- 2026-09: patched: Fix available in DASYLab 2026.0.0 (Build 65)