CVE-2026-64196: Out Of Bounds Write when parsing a .DSB file in DASYLab due to improper validation of user-supplied data, resulting in a write past the end of an allocated heap
There is an out-of-bounds write vulnerability in DASYLab due to improper validation of user-supplied data, resulting in a write past the end of an allocated heap. Successful exploitation requires an attacker to get a user to open a specially crafted .DSB file. This issue affects all versions before 2026.0.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
DASYLabto a version that resolves this vulnerability.Fixed in 2026.0.0 - Compensating control
Mitigate exploitation by preventing users from opening untrusted or specially crafted .DSB files (e.g., restrict/scan incoming .DSB files before opening).
Event History
Frequently Asked Questions
Which deployments are affected?
All DASYLab versions before 2026.0.0 are affected. Systems running version 2026.0.0 or later are not identified as affected by the provided data.
What must an attacker do to exploit this issue?
An attacker must persuade a user to open a specially crafted .DSB file in DASYLab. The attack is local and requires user interaction; no attacker privileges are required.
What should be done if immediate patching is not possible?
Prevent users from opening untrusted or unsolicited .DSB files until DASYLab can be updated to 2026.0.0 or later. Treat .DSB files from unverified sources as potentially malicious.