Executive brief
DASYLab is a data acquisition and signal analysis software platform used for testing and monitoring applications. An out-of-bounds read vulnerability in DSB file parsing can allow attackers to disclose sensitive information or execute code when a user opens a malicious file, requiring no special privileges and affecting all versions before 2026.0.0.
Technical details
This is a CWE-125 out-of-bounds read vulnerability caused by improper validation of user-supplied data during DSB file parsing, specifically during string conversion operations. The vulnerability requires local access and user interaction—an attacker must trick a user into opening a specially crafted DSB file. Exploitation can result in information disclosure through memory reads beyond allocated heap buffer boundaries, and may permit arbitrary code execution within the process context. The vulnerability affects all DASYLab versions before 2026.0.0 (Build 65), which contains the fix. This is part of a set of three related out-of-bounds read issues (CVE-2026-64198, CVE-2026-64199, and CVE-2026-64200) discovered in DSB file parsing.
Affected products
- measX DASYLab before 2026.0.0
Timeline
- 2026-08-17: disclosed: Security advisory published by measX
- 2026.0.0: patched: Fixed in DASYLab 2026.0.0 (Build 65)