EUVD-2026-70767
GHSA-3jcp-wwxv-cmv9
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
File-parsing trigger requires local access and user interaction (UI:R); no attacker privileges needed; no scope change; full C/I/A impact when OOB write reaches code execution.
Primary rating from Vendor (NI).
CVSS VectorVendor: NI
Lifecycle Timeline
3DescriptionCVE.org
There is an out-of-bounds write vulnerability in DASYLab due to lack of proper validation of user-supplied data. Successful exploitation requires an attacker to get a user to open a specially crafted .DSB file. This issue affects all versions before 2026.0.0.
AnalysisAI
Out-of-bounds write in DASYLab's .DSB worksheet file parser allows an attacker to achieve code execution with full confidentiality, integrity, and availability impact by convincing a user to open a crafted file. All versions of DASYLab prior to 2026.0.0, as published by MeasX (formerly National Instruments), are affected. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a user running a vulnerable version of DASYLab (any version prior to 2026.0.0) to open a specially crafted .DSB file; this is encoded in the CVSS 4.0 vector as UI:P (passive user interaction). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P) scores 8.5, accurately capturing the local-file-trigger attack model: the attacker requires no privileges, but user interaction (opening a file) is mandatory. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to DASYLab 2026.0.0 per the MeasX security advisory at https://www.measx.com/en/service/productsecurity/security-updates-for-measx-software/159-securityupdates/1071-out-of-bounds-write-vulnerabilities-in-dasylab-2.html - this is the only confirmed fix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Immediately restrict DASYLab file opening to verified internal sources only and isolate all systems running DASYLab versions prior to 2026.0.0 from sensitive networks pending security assessment. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
There is a deserialization of untrusted data vulnerability in Digilent DASYLab. Rated high severity (CVSS 8.5), this vul
Out-of-bounds write in DASYLab (all versions before 2026.0.0) enables arbitrary code execution when a victim opens a spe
Out-of-bounds heap write in DASYLab before version 2026.0.0 enables arbitrary code execution on the victim's system when
There is an out of bounds write vulnerability due to improper bounds checking resulting in a large destination address w
There is an out of bounds write vulnerability due to improper bounds checking in displ2.dll when parsing a DSB file with
There is an out of bounds write vulnerability due to improper bounds checking resulting in an invalid address when parsi
There is a heap-based Buffer Overflow vulnerability due to improper bounds checking when parsing a DSB file with Digilen
There is an out of bounds write vulnerability due to improper bounds checking resulting in invalid data when parsing a D
Memory corruption vulnerability in all versions of Digilent DASYLab data acquisition software that occurs when processin
Memory corruption vulnerability in all versions of Digilent DASYLab software that allows attackers to achieve informatio
Memory corruption vulnerability in all versions of Digilent DASYLab that allows attackers to execute arbitrary code or s
Memory corruption vulnerability in all versions of Digilent DASYLab data acquisition software that allows attackers to a
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today