Is CVE-2026-64197 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-64197 being exploited in the wild.

How severe is CVE-2026-64197?

High severity, with a CVSS score of 7.8, published 3 September 2026.

Which products and versions are affected?

measX DASYLab all versions before 2026.0.0 (Build 65).

Is there a fix for CVE-2026-64197?

A patch was published on 2026-09: Fix available in DASYLab 2026.0.0 (Build 65) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-64197 attacked?

It is attacked with local access.

Am I affected by CVE-2026-64197?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-64197: measX DASYLab out-of-bounds write in DSB parsing

CVE-2026-64197 · Severity: high · CVSS 7.8 · Published 2026-09-03

DASYLab is a data acquisition and signal analysis software platform used by engineers for measurement and test applications. This vulnerability allows attackers to execute arbitrary code on a victim's computer if they trick a user into opening a malicious DSB project file. The vulnerability stems from insufficient validation of file data, allowing memory corruption that can lead to system compromise or data theft.

Quick answers

Is CVE-2026-64197 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-64197 being exploited in the wild.
How severe is CVE-2026-64197?: High severity, with a CVSS score of 7.8, published 3 September 2026.
Which products and versions are affected?: measX DASYLab all versions before 2026.0.0 (Build 65).
Is there a fix for CVE-2026-64197?: A patch was published on 2026-09: Fix available in DASYLab 2026.0.0 (Build 65) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-64197 attacked?: It is attacked with local access.
Am I affected by CVE-2026-64197?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

CVE-2026-64197 is an out-of-bounds write vulnerability (CWE-787) in DASYLab's DSB file parser. The vulnerability exists due to improper validation of user-supplied data in DSB files, resulting in a write past the end of an allocated data structure in heap memory. Exploitation requires a user to open a specially crafted DSB file—no authentication, network access, or elevated privileges are required. A successful attack allows arbitrary code execution in the context of the current process with user-level privileges. The vulnerability affects all DASYLab versions before 2026.0.0 (Build 65), and measX has released a patch in DASYLab 2026.0.0 (Build 65).

Affected products

measX DASYLab all versions before 2026.0.0 (Build 65)

Timeline

2026-08-17: disclosed: Security advisory published by measX
2026-09: patched: Fix available in DASYLab 2026.0.0 (Build 65)

References

https://www.measx.com/en/service/productsecurity/security-updates-for-measx-software/159-securityupdates/1071-out-of-bounds-write-vulnerabilities-in-dasylab-2.html

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.