CVE-2026-64200: Out Of Bounds Read in during string conversionwhen parsing a .DSB file in DASYLab

Severity: high (CVSS 7.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-03 · updated 2026-09-22
Weakness: CWE-125

Description

There is an out-of-bounds read vulnerability in DASYLab due to improper validation of user-supplied data. This results in a read a past the end of an allocated heap buffer during string conversion. Successful exploitation requires an attacker to get a user to open a specially crafted .DSB file. This issue affects all versions before 2026.0.0.

Affected products

Digilent DASYLab: before 2026.0; 2026.0, 2026.0-build_32 — fixed in 2026.0

How to fix

Upgrade to a fixed version: Digilent DASYLab 2026.0. Check the vendor advisory for mitigations.

References

https://www.measx.com/en/service/productsecurity/security-updates-for-measx-software/159-securityupdates/1070-out-of-bounds-read-vulnerabilities-in-dasylab-2.html

Get alerted when CVE-2026-64200 or the next vulnerability affects your stack