# CVE-2026-64200: measX DASYLab out-of-bounds read in DSB file parsing

Source: https://junglewise.ai/threats/cve-2026-64200-measx-dasylab-out-of-bounds-read-in-dsb-file-parsing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-03. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-64200 · Severity: high · CVSS 7.8 · Published 2026-09-03

DASYLab is a data acquisition and signal analysis software platform used for testing and monitoring applications. An out-of-bounds read vulnerability in DSB file parsing can allow attackers to disclose sensitive information or execute code when a user opens a malicious file, requiring no special privileges and affecting all versions before 2026.0.0.

## Quick answers

**Is CVE-2026-64200 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-64200 being exploited in the wild.

**How severe is CVE-2026-64200?** High severity, with a CVSS score of 7.8, published 3 September 2026.

**Which products and versions are affected?** measX DASYLab before 2026.0.0.

**Is there a fix for CVE-2026-64200?** A patch was published on 2026.0.0: Fixed in DASYLab 2026.0.0 (Build 65) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-64200 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-64200?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a CWE-125 out-of-bounds read vulnerability caused by improper validation of user-supplied data during DSB file parsing, specifically during string conversion operations. The vulnerability requires local access and user interaction—an attacker must trick a user into opening a specially crafted DSB file. Exploitation can result in information disclosure through memory reads beyond allocated heap buffer boundaries, and may permit arbitrary code execution within the process context. The vulnerability affects all DASYLab versions before 2026.0.0 (Build 65), which contains the fix. This is part of a set of three related out-of-bounds read issues (CVE-2026-64198, CVE-2026-64199, and CVE-2026-64200) discovered in DSB file parsing.

## Affected products

- measX DASYLab before 2026.0.0

## Timeline

- 2026-08-17: disclosed: Security advisory published by measX
- 2026.0.0: patched: Fixed in DASYLab 2026.0.0 (Build 65)

## References

- [https://www.measx.com/en/service/productsecurity/security-updates-for-measx-software/159-securityupdates/1070-out-of-bounds-read-vulnerabilities-in-dasylab-2.html](https://www.measx.com/en/service/productsecurity/security-updates-for-measx-software/159-securityupdates/1070-out-of-bounds-read-vulnerabilities-in-dasylab-2.html)