Description
There is a memory corruption vulnerability due to an out-of-bounds write when loading a corrupted DSB file in Digilent DASYLab.  This vulnerability may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted .DSB file. This vulnerability affects all versions of Digilent DASYLab.
Published: 2026-03-13
Score: 8.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

This vulnerability is a memory corruption issue caused by an out‑of‑bounds write that occurs when Digilent DASYLab opens a corrupted .DSB file. The flaw can lead to information disclosure or arbitrary code execution, as indicated by the vulnerability description and the CVE score of 8.5. It is characterized by CWE‑787."

Affected Systems

All versions of Digilent DASYLab are affected. The affected product is listed in the vendor/product list as Digilent:DASYLab and the CPE string cpe:2.3:a:ni:dasylab:*:*:*:*:*:*:*:* indicates a broad application across all releases.

Risk and Exploitability

The CVSS score of 8.5 denotes high severity, but the EPSS score is reported as less than 1%, suggesting low exploitation probability at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to supply a specially crafted .DSB file and convince a user to open it, indicating that user interaction is a prerequisite for success. Because of the high impact and user‑dependent attack vector, the overall risk can be considered moderate with a clear potential for severe compromise if an exploit is delivered to an end‑user.

Generated by OpenCVE AI on March 19, 2026 at 18:27 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Check the Digilent or National Instruments security update page for an available patch or newer version of DASYLab.
  • Do not open unfamiliar or untrusted .DSB files until a patch has been applied.
  • Apply the vendor’s patch or upgrade to the latest supported version of DASYLab as soon as possible.
  • Limit the use of DASYLab to trusted users and restrict file download permissions as a temporary control.
  • Monitor system logs for unexpected activity related to DASYLab operations.

Generated by OpenCVE AI on March 19, 2026 at 18:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 19 Mar 2026 17:45:00 +0000

Type Values Removed Values Added
First Time appeared Ni
Ni dasylab
CPEs cpe:2.3:a:ni:dasylab:*:*:*:*:*:*:*:*
Vendors & Products Ni
Ni dasylab

Mon, 16 Mar 2026 10:15:00 +0000

Type Values Removed Values Added
First Time appeared Digilent
Digilent dasylab
Vendors & Products Digilent
Digilent dasylab

Sun, 15 Mar 2026 02:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

 ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 13 Mar 2026 18:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 13 Mar 2026 14:45:00 +0000

Type Values Removed Values Added
Description There is a memory corruption vulnerability due to an out-of-bounds write when loading a corrupted DSB file in Digilent DASYLab.  This vulnerability may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted .DSB file. This vulnerability affects all versions of Digilent DASYLab.
Title Out-Of-Bounds Write When Opening a Corrupt DSB File in Digilent DASYLab
Weaknesses CWE-787
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 8.5, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Digilent Dasylab
Ni Dasylab
cve-icon MITRE

Status: PUBLISHED

Assigner: NI

Published:

Updated: 2026-03-15T01:51:19.364Z

Reserved: 2026-01-14T19:16:22.774Z

Link: CVE-2026-0954

cve-icon Vulnrichment

Updated: 2026-03-13T18:07:38.783Z

cve-icon NVD

Status : Analyzed

Published: 2026-03-13T19:53:57.210

Modified: 2026-03-19T17:40:06.383

Link: CVE-2026-0954

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-03-23T12:02:56Z

Weaknesses