EUVD-2026-70823
GHSA-fgv7-3g4x-j73v
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
File must be locally opened by a user (AV:L, UI:R); OOB read yields heap disclosure (C:H) and potential crash (A:H) but no integrity impact.
Primary rating from Vendor (ni).
CVSS VectorVendor: ni
Lifecycle Timeline
3DescriptionCVE.org
There is an out-of-bounds read vulnerability in DASYLab due to improper validation of user-supplied data. This results in a read a few bytes past the end of an allocated heap buffer during file handling. Successful exploitation requires an attacker to get a user to open a specially crafted .DSB file. This issue affects all versions before 2026.0.0.
AnalysisAI
Out-of-bounds heap read during .DSB file parsing in DASYLab (all versions prior to 2026.0.0) allows an attacker who can persuade a user to open a specially crafted data file to potentially disclose heap memory contents and crash the application. The root cause is CWE-125: insufficient validation of user-supplied length or offset fields during file-handling routines, causing reads a few bytes past an allocated heap buffer boundary. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that a user opens a specially crafted .DSB file in DASYLab running any version prior to 2026.0.0. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 4.0 score of 8.5 with VC:H/VI:H/VA:H warrants scrutiny: a pure out-of-bounds read of a few bytes past a heap buffer boundary realistically yields heap information disclosure (C:H) and a potential crash (A:H), but integrity impact (VI:H) is difficult to reconcile with the description, which does not suggest memory writes or code execution - this metric appears overstated unless the OOB read enables a secondary exploitation primitive not described. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade DASYLab to version 2026.0.0 or later, which resolves this vulnerability per the MeasX security advisory at https://www.measx.com/en/service/productsecurity/security-updates-for-measx-software/159-securityupdates/1070-out-of-bounds-read-vulnerabilities-in-dasylab-2.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify and catalog all DASYLab deployments and versions currently in use. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today