DASYLab CVE-2026-64200

The target must be running DASYLab prior to version 2026.0.0 and must open a specially crafted .DSB file provided by the attacker. Exploitation is entirely dependent on user interaction - the victim must actively open the malicious file, whether delivered via email, download, shared drive, or other file transfer mechanism. No network-facing service is involved; the vulnerability exists solely in the file-parsing code path. There is no authentication barrier for the attacker, as the attack is file-based. Exploitation is limited by: (1) the requirement for social engineering or supply-chain-level file substitution to deliver the crafted .DSB file; (2) DASYLab's typical deployment in controlled industrial and research environments where external file ingestion may be restricted; (3) ASLR/heap hardening on modern operating systems, which raises the bar for converting an OOB read into reliable code execution.

The CVSS 4.0 score of 8.5 with vector AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H reflects high impact but a constrained attack vector: exploitation is local (file-based) and requires passive user interaction (opening a .DSB file). This is not a remotely exploitable vulnerability without a delivery mechanism. The attacker cannot reach DASYLab over a network directly; they must first convince a target to open a crafted file. EPSS data is not provided, and the vulnerability is not in CISA KEV, so no confirmed active exploitation exists. The high C/I/A impact rating in the CVSS 4.0 vector is notable for what is described as an OOB read - this suggests the vendor or reporter assessed exploitation potential beyond pure information disclosure, possibly including crash-induced code execution paths. The software is primarily deployed in industrial, scientific, and research environments, meaning target populations are specialized rather than broad; nonetheless, a research lab or industrial operator running an unpatched version and handling externally-sourced .DSB files faces real risk. No public exploit code is identified at time of analysis.

An attacker crafts a malicious .DSB workspace file with a string field whose length metadata is manipulated to cause DASYLab's string conversion routine to read past the end of a heap buffer. The attacker delivers this file to a target engineer via email or a shared project repository, relying on the victim's normal workflow of opening DASYLab workspaces. Upon opening the file, the OOB read triggers, potentially leaking heap memory contents or causing a crash that could be further developed into code execution.