CVE-2025-9189

Executive Summary

CVE-2025-9189 is an out-of-bounds write vulnerability (CWE-1285) in Digilent DASYLab that is triggered when the application parses a specially crafted DSB file. Improper bounds checking produces a disproportionately large destination address during parsing, enabling memory corruption that may be leveraged for arbitrary code execution. The flaw affects all versions of DASYLab and requires user interaction (opening a malicious DSB file), yielding a CVSS 3.1 base score of 7.8 (High). Organizations using DASYLab for data acquisition and measurement automation should treat untrusted DSB files as hostile input.

Technical Analysis

DASYLab is a graphical data acquisition, measurement, and control application from Digilent (originally distributed by National Instruments / Measurement Computing lineage). DSB files are DASYLab worksheet/diagram files that define the layout and processing pipeline of a measurement project.

According to the CNA and NVD descriptions, CVE-2025-9189 is an out-of-bounds write arising from improper bounds checking. Specifically, the flaw manifests as a "large destination address" when the parser processes a DSB file. This indicates that a value derived from file contents is used to compute a destination pointer/write offset, and because the bounds check is absent or ineffective, the computed destination is not constrained to the intended buffer. The result is a write to memory outside the allocated region.

Mapping to CWE-1285 (Improper Validation of Specified Index, Position, or Offset in Input) is consistent with the described behavior: the parser trusts an offset/position value embedded in the file and fails to validate it against buffer boundaries before performing the write. Classified effects are memory corruption — potential heap or stack out-of-bounds write depending on where the destination buffer is allocated.

Attack surface considerations:

• Input vector: a malicious DSB file delivered to and opened by a DASYLab user.
• Parse-time trigger: the out-of-bounds write occurs during file parsing, meaning merely opening the file (not executing a worksheet operation) is sufficient to reach the vulnerable code path.
• No authentication is required (PR:N); the only precondition is user interaction (UI:R) to open the file.
• Local attack vector (AV:L) per the CVSS vector, consistent with file-based delivery where the attacker places a file on the system or convinces the user to open a downloaded file; the file may also arrive via email, shared drive, or web download.

No public proof-of-concept, exploit code, or Nuclei template is available for this CVE. The description does not name specific functions, file-format fields, offsets, or DLLs; accordingly, no code-level function names are asserted here. The vulnerability class (unvalidated embedded offset leading to a large out-of-bounds write) is the reliable basis for the detection and mitigation guidance below.

Because no vendor fix version is specified and all versions are affected, there is no patched-build comparison to perform. Defenders must rely on input handling controls, allow-listing, and endpoint monitoring rather than signature-of-patched-binary comparison.

Exploitation Scenarios

No public PoC exists; the following attack chain is inferred at the vulnerability-class level from the NVD/CNA description.

1. Reconnaissance / target identification. The attacker identifies an environment where DASYLab is deployed — typically engineering, test & measurement, or lab environments where DSB worksheets are routinely exchanged. DASYLab installations can be fingerprinted through software inventory, shared file repositories containing .dsb artifacts, and endpoint telemetry (DASYLab process execution). The absence of a public product-specific Shodan fingerprint means network reconnaissance is secondary; the primary recon is identifying users who open DSB files.

2. Triggering the specific flaw class. The attacker crafts a DSB file containing manipulated structural values such that, during parsing, an embedded position/offset is interpreted as a destination for a write. Because bounds checking is improper (CWE-1285), the parser computes a "large destination address" and performs the write beyond the intended buffer boundary. The trigger condition is simply parsing the file — the user opens the file in DASYLab.

3. Payload / execution method (class level). An out-of-bounds write of this nature can corrupt adjacent memory structures. Depending on the allocator layout and the value written, an attacker may overwrite control data (e.g., pointers or length fields) to redirect execution. The NVD description states this "may result in arbitrary code execution." The precise step from corruption to control-flow hijack depends on runtime layout and mitigations, which are not documented in the available advisory; no specific overwrite target (function pointer, return address, vtable, etc.) is asserted here.

4. Post-exploitation impact. Successful exploitation is rated C:H/I:H/A:H — total loss of confidentiality, integrity, and availability for the DASYLab user context. Because the vector is local to the user, the attacker inherits that user's permissions. In engineering environments, this can mean access to measurement data, project files, network shares mapped to the user, and the ability to pivot within the lab/OT segment.

Delivery considerations (class level): email attachment, shared network folder, USB media, or download link. The requirement UI:R means the attacker depends on social engineering or workflow assumptions (e.g., "review this worksheet").

Known exploitation in the wild: none reported. CISA KEV: NO. EPSS 0.00283 (18.6th percentile) — low predicted exploitation probability at time of writing.

Impact Assessment

CVSS 3.1 base score 7.8 (High). Subscores:

• AV:L (Local): the attack is delivered via a file on the local system, not over a network service.
• AC:L (Low): no special conditions beyond opening the file; the parsing path is deterministic.
• PR:N (None): no authentication or privileges required.
• UI:R (Required): a user must open the crafted DSB file.
• S:U (Unchanged): impact is scoped to the DASYLab process/authorization context.
• C:H / I:H / A:H: full compromise of confidentiality, integrity, and availability for that context.

Business impact: DASYLab is used in test, measurement, and data-acquisition workflows, frequently in engineering labs and sometimes adjacent to OT/ICS-adjacent environments. A compromise of a workstation running DASYLab can expose proprietary test data and project files, enable lateral movement using the user's credentials, and — in environments where measurement systems integrate with production or QA pipelines — introduce data-integrity risk. Blast radius is limited per-host to the victim user's context, but file-based delivery can be mass-distributed (email, shared drives), scaling the number of potentially affected endpoints.

Affected systems: any host with Digilent DASYLab installed, across all versions. No specific version range is excluded.

Detection Guidance

Sigma Rule

title: Potential DASYLab DSB File Exploitation (CVE-2025-9189)
id: 5b7e9c2a-3f1d-4a8e-9c6b-1d2e3f4a5b6c
status: experimental
description: Detects process creation and crash behavior consistent with opening a malicious DSB file in Digilent DASYLab, where an out-of-bounds write may lead to code execution.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2025-9189
author: Valters IT Threat Intelligence
date: 2025-01-01
tags:
  - attack.t1204.002
  - attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\dasylab.exe'
      - '\dasylab64.exe'
  selection_spawn:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
  condition: selection_parent and selection_spawn
falsepositives:
  - Legitimate DASYLab scripts invoking helper processes
level: high
---
title: DASYLab Application Crash Indicative of DSB Parsing OOB Write
id: 7c1a4f6e-9d2b-4e3a-b8c5-2f3e4d5a6b7c
status: experimental
description: Detects application error events from DASYLab processes, which may indicate exploitation attempts of CVE-2025-9189.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2025-9189
author: Valters IT Threat Intelligence
date: 2025-01-01
logsource:
  product: windows
  service: application
detection:
  selection:
    Provider|contains: 'Application Error'
    Data|contains:
      - 'dasylab'
  condition: selection
falsepositives:
  - Legitimate DASYLab crashes during normal file operations
level: medium

YARA Rule

rule CVE_2025_9189_DASYLab_DSB_OOB
{
    meta:
        description = "Detects DSB files exhibiting suspicious structure potentially related to CVE-2025-9189 out-of-bounds write in Digilent DASYLab"
        author = "Valters IT Threat Intelligence"
        date = "2025-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-9189"
        cve = "CVE-2025-9189"

    strings:
        $dsb_magic = { 44 53 42 }      // "DSB" worksheet marker (format heuristic)
        $dsb_chunk = "DSBD" ascii
        $dsb_chunk2 = "DASYLab" ascii wide

    condition:
        (uint16(0) == 0x5344 or $dsb_magic at 0 or $dsb_chunk or $dsb_chunk2) and
        filesize < 50MB
}

Note: no public sample of the malicious file structure is available, so the above uses generic DASYLab DSB format markers as heuristics. Tune the strings to your environment's known-good DSB corpus and flag outliers (e.g., files whose embedded length/offset fields deviate from norm) during DFIR triage.

Suricata IDS Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-9189 Digilent DASYLab DSB File Download Attempt"; flow:established,to_server; content:"|2e 64 73 62|"; http.uri; content:"dsb"; http.header; classtype:attempted-user; reference:cve,2025-9189; sid:90009189; rev:1;)

alert smb any any -> any any (msg:"CVE-2025-9189 DASYLab DSB File Transfer Over SMB"; flow:to_client,established; content:"|2e 64 73 62|"; fileext:"dsb"; filename:"dsb"; classtype:attempted-user; reference:cve,2025-9189; sid:90009190; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET 25 110 143 (msg:"CVE-2025-9189 DASYLab DSB Attachment Delivery via Mail Protocol"; flow:to_client,established; content:".dsb"; nocase; fileext:"dsb"; classtype:attempted-user; reference:cve,2025-9189; sid:90009191; rev:1;)

Note: detection is based on DSB file delivery over common channels (HTTP, SMB, mail) since the exploit itself is local file parsing. Network monitoring should focus on tracking .dsb distribution to endpoints running DASYLab.

Elastic Detection

// Detect DASYLab spawning command/script interpreters (post-exploitation of CVE-2025-9189)
process where event.type == "start" and
  process.parent.name in ("dasylab.exe", "dasylab64.exe") and
  process.name in ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe")

// Detect DASYLab process crashes potentially triggered by malformed DSB parsing
process where event.type == "start" and
  process.name : "dasylab*" and
  process.command_line : "*.dsb" and
  process.exit_code != 0

Splunk SPL Query

index=windows (source="WinEventLog:Application" OR source="WinEventLog:Sysmon")
| eval dsb=if(searchmatch("dasylab OR .dsb OR DSB"), 1, 0)
| where dsb=1
| eval suspicious=case(
    match(_raw,"(?i)dasylab(64)?\.exe.*(cmd\.exe|powershell\.exe|wscript\.exe|mshta\.exe|rundll32\.exe)"),"process_spawn",
    match(_raw,"(?i)Application Error") AND match(_raw,"(?i)dasylab"),"crash_oob",
    match(_raw,"(?i)\.dsb") AND match(_raw,"(?i)(\\temp\\|\\downloads\\|\\appdata\\|\\users\\public\\)"),"suspicious_dsb_path",
    1==1,"informational")
| where suspicious != "informational"
| stats count values(suspicious) as indicators values(process_name) as processes by host, user
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="windows,dasylab,cve-2025-9189,">
  <rule id="100189" level="3">
    <if_sid>60000</if_sid>
    <field name="win.system.providerName">Application Error</field>
    <field name="win.system.message">\.dsb|DASYLab|dasylab</field>
    <description>CVE-2025-9189: Possible DASYLab crash from malformed DSB file parsing</description>
    <mitre>
      <id>T1204.002</id>
    </mitre>
  </rule>

  <rule id="100190" level="12">
    <if_sid>61603</if_sid>
    <field name="win.eventdata.parentImage">\\dasylab(64)?\.exe</field>
    <field name="win.eventdata.image">\\(cmd|powershell|wscript|cscript|mshta|rundll32)\.exe</field>
    <description>CVE-2025-9189: DASYLab spawned a script interpreter - possible code execution via malicious DSB file</description>
    <mitre>
      <id>T1204.002</id>
      <id>T1059</id>
    </mitre>
  </rule>

  <rule id="100191" level="8">
    <if_sid>61600</if_sid>
    <field name="win.eventdata.image">\\dasylab(64)?\.exe</field>
    <field name="win.eventdata.commandLine">\.dsb</field>
    <description>CVE-2025-9189: DASYLab opened a DSB file - monitor for OOB-write exploitation</description>
    <mitre>
      <id>T1204.002</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — a single source lists a patch/fix; not independently confirmed). No vendor fix version or advisory URL is provided, and no explicit workaround is documented by the vendor.

1. Immediate mitigations

• Treat all DSB files from external or untrusted sources as hostile. Block .dsb attachments at the email gateway and web proxy where business process permits.
• Enforce strict file-origin controls: users should only open DSB worksheets from vetted internal repositories.
• Where DASYLab is not required, remove or blocklist it via application control (WDAC/AppLocker).
• If DASYLab must parse external worksheets, open untrusted files in a dedicated, low-privilege VM or sandbox without network or share access.
• Apply exploit-mitigation hardening to the host OS (DEP, ASLR, CFG) and ensure endpoint protection performs behavioral blocking on DASYLab-spawned child processes.

2. Patch / upgrade steps

• Verify current patch availability directly with Digilent support and the official DASYLab product/download page before relying on the "claimed" patch status. The available data lists the patch as single-sourced and unconfirmed; there is no published fix version.
• Monitor the NVD entry (CVE-2025-9189) and the Digilent advisory channels for an updated, versioned release. Do not assume "all versions affected" implies an imminent fixed build.
• Once a fix is published, stage it against a test DASYLab installation, confirm parsing behavior with your known-good worksheet corpus, then deploy.

3. Long-term hardening

• Maintain an allow-list of approved DSB file sources and integrate it into your DLP/file-inspection policy.
• Add automated scanning of inbound .dsb artifacts (AV, sandbox detonation) prior to distribution.
• Segment engineering/measurement workstations from general corporate networks to limit lateral movement from a compromised DASYLab host.
• Log and alert on DASYLab process execution and any child-process creation (see detection rules above).
• Include DSB-file handling in security awareness training, emphasizing the requirement for user interaction (UI:R) and file-open social engineering.

References

1. NVD — CVE-2025-9189: https://nvd.nist.gov/vuln/detail/CVE-2025-9189
2. CWE-1285 — Improper Validation of Specified Index, Position, or Offset in Input: https://cwe.mitre.org/data/definitions/1285.html
3. MITRE ATT&CK T1204.002 — User Execution: Malicious File: https://attack.mitre.org/techniques/T1204/002/
4. Digilent DASYLab product page: https://digilent.com/reference/software/dasylab/start
5. CISA Known Exploited Vulnerabilities Catalog (CVE-2025-9189 not listed as of report date): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor activity: none attributed. Exploitation in the wild: no evidence reported. CISA KEV: not listed. EPSS 0.00283 (18.6th percentile). No public PoC, exploit code, or Nuclei template available at time of writing.