DASYLab CVE-2026-64195

Exploitation requires a user running a vulnerable version of DASYLab (any version prior to 2026.0.0) to open a specially crafted .DSB file; this is encoded in the CVSS 4.0 vector as UI:P (passive user interaction). The attack vector is local (AV:L), meaning the malicious file must reach the user's machine or accessible file system through social engineering, phishing, or a compromised file share - no direct network exploitation path exists. No attacker privileges are required (PR:N), and no special non-default configuration of DASYLab is needed. Exploitation is inherently constrained by the need for user interaction and the niche deployment base of DASYLab in laboratory and industrial measurement environments.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P) scores 8.5, accurately capturing the local-file-trigger attack model: the attacker requires no privileges, but user interaction (opening a file) is mandatory. Real-world risk is meaningfully lower than the score alone implies because exploitation depends entirely on social engineering - the victim must be persuaded to open a .DSB file from an untrusted source. No KEV listing and no public POC code have been identified, further reducing immediate threat urgency. The C:H/I:H/A:H impact triad is credible for a heap/stack corruption primitive that reaches code execution. EPSS data was not provided in the input; in the absence of active exploitation signals, prioritization should be driven by user-facing exposure and the feasibility of delivering malicious .DSB files to target users. The vulnerability is a genuine concern for organizations whose DASYLab users routinely exchange worksheet files with external parties.

An attacker crafts a malicious .DSB worksheet file embedding data designed to trigger the out-of-bounds write and packages it as a plausible project file shared via email, a collaboration platform, or a poisoned file repository. A DASYLab user opens the file in the normal course of laboratory work, causing the parser to write beyond its allocated buffer and enabling the attacker to execute arbitrary code within the user's session context. No public proof-of-concept has been identified, but the CWE-787 class is well-understood and the technique is standard in file-format fuzzing campaigns.