ZDI-CAN-28446: ZDI-26-235: Digilent DASYLab DSA File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

Published Mar 30, 2026

Updated

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Digilent DASYLab. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-0957.

Affected Software

1 affected component

Digilent DASYLab

Event History

Mar 30, 2026

Advisory Published

via ZDI·05:00 AM

Data Sourced

via ZDI·05:00 AM

Description

Frequently Asked Questions

What is the severity of ZDI-CAN-28446?

The severity of ZDI-CAN-28446 is classified as critical due to its potential for remote code execution.

How do I fix ZDI-CAN-28446?

To fix ZDI-CAN-28446, update Digilent DASYLab to the latest version provided by the vendor.

What types of attacks can ZDI-CAN-28446 facilitate?

ZDI-CAN-28446 can facilitate remote code execution attacks that allow attackers to execute arbitrary code on targeted systems.

Does ZDI-CAN-28446 require user interaction to exploit?

Yes, ZDI-CAN-28446 requires user interaction for successful exploitation, as the target must open a specially crafted file.

What are the affected installations for ZDI-CAN-28446?

ZDI-CAN-28446 affects installations of Digilent DASYLab that are not patched against this vulnerability.