EUVD-2026-70770
GHSA-28jj-q8cg-6fc9
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
File must be opened locally by the victim (AV:L/UI:R); no attacker authentication required; out-of-bounds write class yields full local code execution potential (C:H/I:H/A:H).
Primary rating from Vendor (NI).
CVSS VectorVendor: NI
Lifecycle Timeline
3DescriptionCVE.org
There is an out-of-bounds write vulnerability in DASYLab due to improper validation of user-supplied data, resulting in a write past the end of an allocated data structure. Successful exploitation requires an attacker to get a user to open a specially crafted .DSB file. This issue affects all versions before 2026.0.0.
AnalysisAI
Out-of-bounds write in DASYLab (all versions before 2026.0.0) enables arbitrary code execution when a victim opens a specially crafted .DSB worksheet file. The flaw, CWE-787, stems from improper validation of user-supplied data within the .DSB file parser, permitting writes past the end of an allocated data structure and corrupting adjacent memory. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the victim to open a specially crafted .DSB file in DASYLab version prior to 2026.0.0 - there is no remote unauthenticated or network-based exploitation path. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.5 with vector AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H accurately reflects the local file-open requirement and high impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade DASYLab to version 2026.0.0 or later, which resolves this out-of-bounds write vulnerability per the measX security advisory at https://www.measx.com/en/service/productsecurity/security-updates-for-measx-software/159-securityupdates/1071-out-of-bounds-write-vulnerabilities-in-dasylab-2.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: issue an alert to all DASYLab users warning against opening .DSB files from untrusted or unverified sources, and create an inventory of DASYLab versions deployed across the organization. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
There is a deserialization of untrusted data vulnerability in Digilent DASYLab. Rated high severity (CVSS 8.5), this vul
Out-of-bounds heap write in DASYLab before version 2026.0.0 enables arbitrary code execution on the victim's system when
Out-of-bounds write in DASYLab's .DSB worksheet file parser allows an attacker to achieve code execution with full confi
There is an out of bounds write vulnerability due to improper bounds checking resulting in a large destination address w
There is an out of bounds write vulnerability due to improper bounds checking in displ2.dll when parsing a DSB file with
There is an out of bounds write vulnerability due to improper bounds checking resulting in an invalid address when parsi
There is a heap-based Buffer Overflow vulnerability due to improper bounds checking when parsing a DSB file with Digilen
There is an out of bounds write vulnerability due to improper bounds checking resulting in invalid data when parsing a D
Memory corruption vulnerability in all versions of Digilent DASYLab data acquisition software that occurs when processin
Memory corruption vulnerability in all versions of Digilent DASYLab software that allows attackers to achieve informatio
Memory corruption vulnerability in all versions of Digilent DASYLab that allows attackers to execute arbitrary code or s
Memory corruption vulnerability in all versions of Digilent DASYLab data acquisition software that allows attackers to a
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today