# CVE-2026-64197: measX DASYLab out-of-bounds write in DSB parsing

Source: https://junglewise.ai/threats/cve-2026-64197-measx-dasylab-out-of-bounds-write-in-dsb-parsing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-03. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-64197 · Severity: high · CVSS 7.8 · Published 2026-09-03

DASYLab is a data acquisition and signal analysis software platform used by engineers for measurement and test applications. This vulnerability allows attackers to execute arbitrary code on a victim's computer if they trick a user into opening a malicious DSB project file. The vulnerability stems from insufficient validation of file data, allowing memory corruption that can lead to system compromise or data theft.

## Quick answers

**Is CVE-2026-64197 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-64197 being exploited in the wild.

**How severe is CVE-2026-64197?** High severity, with a CVSS score of 7.8, published 3 September 2026.

**Which products and versions are affected?** measX DASYLab all versions before 2026.0.0 (Build 65).

**Is there a fix for CVE-2026-64197?** A patch was published on 2026-09: Fix available in DASYLab 2026.0.0 (Build 65) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-64197 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-64197?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

CVE-2026-64197 is an out-of-bounds write vulnerability (CWE-787) in DASYLab's DSB file parser. The vulnerability exists due to improper validation of user-supplied data in DSB files, resulting in a write past the end of an allocated data structure in heap memory. Exploitation requires a user to open a specially crafted DSB file—no authentication, network access, or elevated privileges are required. A successful attack allows arbitrary code execution in the context of the current process with user-level privileges. The vulnerability affects all DASYLab versions before 2026.0.0 (Build 65), and measX has released a patch in DASYLab 2026.0.0 (Build 65).

## Affected products

- measX DASYLab all versions before 2026.0.0 (Build 65)

## Timeline

- 2026-08-17: disclosed: Security advisory published by measX
- 2026-09: patched: Fix available in DASYLab 2026.0.0 (Build 65)

## References

- [https://www.measx.com/en/service/productsecurity/security-updates-for-measx-software/159-securityupdates/1071-out-of-bounds-write-vulnerabilities-in-dasylab-2.html](https://www.measx.com/en/service/productsecurity/security-updates-for-measx-software/159-securityupdates/1071-out-of-bounds-write-vulnerabilities-in-dasylab-2.html)