DASYLab CVE-2026-64199

Exploitation requires a user to actively open a specially crafted .DSB file in an unpatched version of DASYLab (any version before 2026.0.0) - without this user interaction, remote exploitation is not possible. The attacker must craft a malformed .DSB file containing input data that bypasses initial parsing but triggers the out-of-bounds read when a specific data structure is accessed. No authentication, elevated privileges, or network-level access to the target machine is required from the attacker's perspective, beyond delivering the malicious file via phishing, shared drive, or supply-chain vector. Exploitation is limited to Windows hosts running DASYLab (the typical deployment platform for this software) with versions prior to 2026.0.0.

The vendor-supplied CVSS 4.0 score of 8.6 (AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) presents two notable discrepancies worth flagging. First, the UI:N metric contradicts the description, which explicitly states that a user must open a specially crafted file - in CVSS 4.0 terminology, opening a malicious file constitutes active user interaction (UI:A), not zero interaction; this appears to be a metadata error that artificially elevates the score. Second, VI:H (integrity impact on the vulnerable system) is questionable for a CWE-125 out-of-bounds read, which typically affects confidentiality and availability rather than integrity unless a write primitive is chained - this cannot be confirmed without code-level analysis. Correcting these would reduce the effective score. No KEV listing and no known public proof-of-concept further limit near-term exploitation risk. EPSS data is not provided. Real-world risk is primarily relevant to targeted scenarios - industrial espionage, sabotage of measurement workflows, or phishing against engineers - rather than mass exploitation.

An attacker targets a DASYLab operator - such as a test engineer or laboratory technician - by emailing a maliciously crafted .DSB worksheet disguised as a shared measurement project or calibration file. When the victim opens the file in an unpatched DASYLab installation, the parser reads beyond the boundary of an allocated data structure, potentially leaking memory contents and crashing the application; a sophisticated attacker could further leverage the memory disclosure to defeat ASLR and chain a follow-on write primitive for full code execution. No public exploit code has been identified at time of analysis.