EUVD-2026-70769
GHSA-v5qj-5q4r-8fg9
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
File-open trigger requires user interaction (UI:R) and local execution (AV:L); no privileges or special configuration needed, with full triad impact on the vulnerable host.
Primary rating from Vendor (NI).
CVSS VectorVendor: NI
Lifecycle Timeline
3DescriptionCVE.org
There is an out-of-bounds write vulnerability in DASYLab due to improper validation of user-supplied data, resulting in a write past the end of an allocated heap. Successful exploitation requires an attacker to get a user to open a specially crafted .DSB file. This issue affects all versions before 2026.0.0.
AnalysisAI
Out-of-bounds heap write in DASYLab before version 2026.0.0 enables arbitrary code execution on the victim's system when a user opens a maliciously crafted .DSB worksheet file. The flaw stems from insufficient validation of user-supplied data during .DSB file parsing, allowing an attacker to write past the end of an allocated heap buffer (CWE-787). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a user with DASYLab installed to open a specially crafted .DSB file - this is the sole mandatory precondition. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H) accurately reflects the threat model: exploitation is local and file-based, requiring passive user interaction (opening the .DSB file), but once triggered, impact is full compromise of the vulnerable system with high confidentiality, integrity, and availability loss. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to DASYLab 2026.0.0 or later, which resolves this vulnerability per the measX security advisory (https://www.measx.com/en/service/productsecurity/security-updates-for-measx-software/159-securityupdates/1071-out-of-bounds-write-vulnerabilities-in-dasylab-2.html). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all DASYLab installations and versions in your environment and notify users to avoid opening .DSB files from untrusted sources, implementing email filtering for .DSB attachments from external senders. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
There is a deserialization of untrusted data vulnerability in Digilent DASYLab. Rated high severity (CVSS 8.5), this vul
Out-of-bounds write in DASYLab (all versions before 2026.0.0) enables arbitrary code execution when a victim opens a spe
Out-of-bounds write in DASYLab's .DSB worksheet file parser allows an attacker to achieve code execution with full confi
There is an out of bounds write vulnerability due to improper bounds checking resulting in a large destination address w
There is an out of bounds write vulnerability due to improper bounds checking in displ2.dll when parsing a DSB file with
There is an out of bounds write vulnerability due to improper bounds checking resulting in an invalid address when parsi
There is a heap-based Buffer Overflow vulnerability due to improper bounds checking when parsing a DSB file with Digilen
There is an out of bounds write vulnerability due to improper bounds checking resulting in invalid data when parsing a D
Memory corruption vulnerability in all versions of Digilent DASYLab data acquisition software that occurs when processin
Memory corruption vulnerability in all versions of Digilent DASYLab software that allows attackers to achieve informatio
Memory corruption vulnerability in all versions of Digilent DASYLab that allows attackers to execute arbitrary code or s
Memory corruption vulnerability in all versions of Digilent DASYLab data acquisition software that allows attackers to a
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today