DASYLab DSB Parser Out-of-Bounds Write Vulnerabilities (CVE-2026-64195/96/97)

DASYLab Out-of-Bounds Write Vulnerabilities Vulnerability Overview DASYLab contains multiple out-of-bounds write vulnerabilities when parsing user-supplied files, which may lead to information disclosure or arbitrary code execution. Successful exploitation requires the user to open a specially crafted DSB file. These vulnerabilities affect all versions prior to DASYLab 2026.0.0 (Build 65). Scope of Impact Affected Versions: All versions prior to DASYLab 2026.0.0 (Build 65) CVE Identifiers: - CVE-2026-64195 - CVE-2026-64196 - CVE-2026-64197 CVSS Scores (CVSS 3.1): - CVE-2026-64195: 7.8 (Vector: AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) - CVE-2026-64196: 7.8 (Vector: AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) - CVE-2026-64197: 7.8 (Vector: AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Severity Rating: All three vulnerabilities are classified as High. Vulnerability Details CVE-2026-64195: An out-of-bounds write occurs at the end of an allocated heap buffer during DSB file parsing due to a lack of validation of user-uploaded data. CVE-2026-64196: An out-of-bounds write occurs at the end of an allocated heap buffer during DSB file parsing due to improper validation. CVE-2026-64197: An out-of-bounds write occurs at the end of an allocated data structure during DSB file parsing due to improper validation. Exploitation Condition: An attacker can execute code in the current process context by getting a user to open a specially crafted DSB file. Report Date: July 10, 2024 (Build 26), confirmed on Windows 10 22H2 x64. Remediation Mitigations: Users should upgrade to DASYLab 2026.0.0 (Build 65) or later; avoid opening DASYLab or DSB files of unknown origin. Affected Product Status: - DASYLab 2026.0.0 (Build 65): Not Affected - Versions prior to DASYLab 2026.0.0 (Build 65): Affected Acknowledgments measX thanks Michael Hird for reporting these issues and coordinating the disclosure. Related Resources CWE-787: Out-of-Bounds Write FIRST CVSS v3.1 Calculator NVD Entries: CVE-2026-64195, CVE-2026-64196, CVE-2026-64197 DASYLab Product Page measX Product Security Page > Note: The page does not include POC or exploit code blocks.

Goal Reached Thanks to every supporter — we hit 100%!

DASYLab DSB Parser Out-of-Bounds Write Vulnerabilities (CVE-2026-64195/96/97)

More from this source