EUVD-2026-70822
GHSA-phqm-v98p-hr87
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
File-open trigger requires active UI:R; OOB read impacts confidentiality and availability but integrity impact unconfirmed for CWE-125.
Primary rating from Vendor (ni).
CVSS VectorVendor: ni
Lifecycle Timeline
4DescriptionCVE.org
There is an out-of-bounds read vulnerability in DASYLab due to improper validation of user-supplied data. This results in a read outside the bounds of an allocated data structure. Successful exploitation requires an attacker to get a user to open a specially crafted .DSB file. This issue affects all versions before 2026.0.0.
AnalysisAI
Out-of-bounds memory read in DASYLab's .DSB file parser (all versions before 2026.0.0) allows an attacker to read beyond the bounds of an allocated data structure, potentially disclosing adjacent memory contents and crashing the application. Exploitation requires convincing a user - typically an engineer, lab technician, or researcher - to open a specially crafted DASYLab worksheet file. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a user to actively open a specially crafted .DSB file in an unpatched version of DASYLab (any version before 2026.0.0) - without this user interaction, remote exploitation is not possible. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-supplied CVSS 4.0 score of 8.6 (AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) presents two notable discrepancies worth flagging. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade DASYLab to version 2026.0.0 or later, which resolves this out-of-bounds read vulnerability per the measX security advisory at https://www.measx.com/en/service/productsecurity/security-updates-for-measx-software/159-securityupdates/1070-out-of-bounds-read-vulnerabilities-in-dasylab-2.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all DASYLab installations and determine current versions in use; restrict external .DSB file sources or disable automated file processing until upgrades can be validated. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today