CVE-2026-64196: Out Of Bounds Write when parsing a .DSB file in DASYLab due to improper validation of user-supplied data, resulting in a write past the end of an allocated heap

Q: Which deployments are affected?

All DASYLab versions before 2026.0.0 are affected. Systems running version 2026.0.0 or later are not identified as affected by the provided data.

Q: What must an attacker do to exploit this issue?

An attacker must persuade a user to open a specially crafted .DSB file in DASYLab. The attack is local and requires user interaction; no attacker privileges are required.

Q: What should be done if immediate patching is not possible?

Prevent users from opening untrusted or unsolicited .DSB files until DASYLab can be updated to 2026.0.0 or later. Treat .DSB files from unverified sources as potentially malicious.

Published Sep 3, 2026

Updated

There is an out-of-bounds write vulnerability in DASYLab due to improper validation of user-supplied data, resulting in a write past the end of an allocated heap. Successful exploitation requires an attacker to get a user to open a specially crafted .DSB file. This issue affects all versions before 2026.0.0.

Affected Software

1 affected component

DASYLab DASYLab<2026.0.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade DASYLab to a version that resolves this vulnerability.
Fixed in 2026.0.0
Compensating control
Mitigate exploitation by preventing users from opening untrusted or specially crafted .DSB files (e.g., restrict/scan incoming .DSB files before opening).

Event History

Sep 3, 2026

CVE Published

via MITRE·09:46 PM

Data Sourced

via MITRE·09:46 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

All DASYLab versions before 2026.0.0 are affected. Systems running version 2026.0.0 or later are not identified as affected by the provided data.

What must an attacker do to exploit this issue?

An attacker must persuade a user to open a specially crafted .DSB file in DASYLab. The attack is local and requires user interaction; no attacker privileges are required.

What should be done if immediate patching is not possible?

Prevent users from opening untrusted or unsolicited .DSB files until DASYLab can be updated to 2026.0.0 or later. Treat .DSB files from unverified sources as potentially malicious.

CVE-2026-64196: Out Of Bounds Write when parsing a .DSB file in DASYLab due to improper validation of user-supplied data, resulting in a write past the end of an allocated heap

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

What must an attacker do to exploit this issue?

What should be done if immediate patching is not possible?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What must an attacker do to exploit this issue?

What should be done if immediate patching is not possible?