Executive brief
DASYLab is a data acquisition and signal analysis software platform used by engineers and researchers for real-time measurement and automation. An out-of-bounds read vulnerability in its DSB file parser can leak sensitive memory contents or enable arbitrary code execution when a user opens a malicious file. Exploitation requires local user interaction and cannot be performed remotely.
Technical details
CVE-2026-64198 is an out-of-bounds read vulnerability (CWE-125) in DASYLab's DSB file parser caused by improper validation of user-supplied data. The vulnerability occurs during file handling when parsing specially crafted DSB files, resulting in reads a few bytes past the end of an allocated heap buffer. The attack vector is local and requires user interaction—an attacker must trick a user into opening a malicious DSB file. Successful exploitation can result in information disclosure or arbitrary code execution in the context of the DASYLab process. The vulnerability is fixed in DASYLab version 2026.0.0 (Build 65) and later.
Affected products
- measX DASYLab before 2026.0.0 (Build 65)
Timeline
- 2026-08-17: disclosed
- 2026-09-03: patched: Fixed in DASYLab 2026.0.0 (Build 65)