CVE-2026-64195

Executive Summary

CVE-2026-64195 is an out-of-bounds write (CWE-787) vulnerability in NI DASYLab caused by a lack of proper validation of user-supplied data. Successful exploitation requires a victim to open a specially crafted .DSB file, after which an attacker can corrupt memory and potentially achieve code execution in the context of the user. All DASYLab versions before 2026.0.0 are affected, and because exploitation is local and user-interaction-driven, the primary risk surface is engineering workstations that exchange .DSB project files.

Technical Analysis

The flaw is classified as CWE-787: Out-of-bounds Write, arising from insufficient validation of user-supplied data. Per the NVD description, the vulnerability is reachable when a user opens a specially crafted .DSB file, which is the DASYLab worksheet/project file format. The parser that processes this file does not adequately validate input before using it in a memory write operation, allowing data to be written beyond the bounds of an allocated buffer.

Because the description does not disclose specific function names, parser routines, field offsets, or the precise buffer that is overflowed, the following must be understood at the vulnerability-class level. An out-of-bounds write occurs when a program computes a write destination or length from attacker-controlled input without bounding it against the size of the destination buffer. In the context of a file-format parser, this typically means a length, count, or index value embedded in the file is trusted and used directly to drive a memory write. A crafted .DSB file can therefore influence the size or destination of that write, corrupting adjacent memory (including heap or stack metadata, function pointers, or control structures) and potentially leading to arbitrary code execution.

The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects the following practical characteristics: the attack vector is Local (the malicious file must be present on or delivered to the host and opened), attack complexity is Low (no race conditions or special preconditions beyond the file itself), no privileges are required (PR:N), but user interaction is required (UI:R) because a victim must open the file. The scope is Unchanged, meaning exploitation stays within the vulnerable application's security authority. Confidentiality, Integrity, and Availability impacts are all High, consistent with a memory-corruption primitive that can yield code execution and crash/corruption effects.

The EPSS score of 0.00158 (4.2% percentile) indicates that, at the time of assessment, there is very little observed exploitation activity in the wild relative to other CVEs. The public PoC status is listed, but no exploit code artifact is confirmed available, and no Nuclei template exists. Patch confidence is 2/4 (CLAIMED) — a single source (NVD) asserts a fix in 2026.0.0, and this has not been independently verified. There is no CISA KEV listing, and no evidence of active threat-actor campaigns is provided in the data set.

Exploitation Scenarios

The following attack chain is inferred from the vulnerability class and the NVD description. No public exploit code or template is confirmed, and no specific internal identifiers (functions, offsets, fields) are available; the chain is therefore described at the mechanism level only.

1. Reconnaissance / target identification. An attacker identifies targets that use NI DASYLab for measurement-data acquisition and analysis — typically engineering, test, and instrumentation teams that regularly open shared .DSB worksheets. Because the attack vector is local and requires user interaction, the attacker seeks a delivery path to a machine where DASYLab is installed, such as shared network folders, email attachments, removable media, or project-file exchanges between colleagues.

2. Delivery and trigger. The attacker crafts a .DSB file containing malformed data that the DASYLab parser fails to validate. The file is delivered to the victim through the chosen channel, and the victim is induced to open it in DASYLab. This single user action satisfies the UI:R requirement. No elevated privileges are needed (PR:N) and no special conditions beyond opening the file (AC:L) are required.

3. Payload / execution at the vulnerability-class level. When DASYLab parses the crafted file, the unvalidated input drives a write past the end of an allocated buffer. The out-of-bounds write corrupts adjacent memory. Depending on the layout, this corruption can be leveraged to hijack control flow with the goal of executing attacker-chosen code in the user's session, or it may simply cause a crash. Because the description does not expose the exact buffer, size field, or write primitive, no specific exploit technique or structure layout can be asserted here.

4. Post-exploitation impact. If control-flow hijack is achieved, the attacker obtains code execution in the context of the user who opened the file. Given C:H/I:H/A:H, this can compromise the confidentiality of data accessible to that user, allow modification of files and measurement data, and allow disruption of the application or workstation. In an engineering environment, that may expose proprietary designs, test results, or credentials and provide a foothold for lateral movement.

It must be emphasized that no public PoC is confirmed in the provided data, and no exploit-in-the-wild evidence exists; this scenario is a reasoned extrapolation from the CWE-787 class and the stated trigger mechanism.

Impact Assessment

The CVSS base score is 7.8 (High). Impact is localized to the machine of the user who opens the malicious file, but the severity of that impact is high: successful exploitation provides a memory-corruption primitive with the potential for arbitrary code execution in the victim's security context. The UI:R requirement lowers attack likelihood somewhat, but DASYLab's workflow inherently involves opening worksheet files, so the required interaction is a normal part of operations and is easy to induce.

Affected systems are all DASYLab installations below version 2026.0.0, including engineering workstations, test benches, and laboratory data-acquisition hosts. The blast radius is bounded by the user's privileges rather than elevated system privileges, but in many engineering environments users have broad access to sensitive design, measurement, and project data. The Unchanged scope (S:U) means the exploit's effect stays within the vulnerable application's authority rather than directly compromising other security principals; however, a code-execution primitive obtained under a user account commonly enables follow-on activity.

Business impact includes potential loss of proprietary measurement/design data, integrity compromise of test results (which can have safety and quality implications in regulated engineering environments), workstation downtime from crashes or corruption, and use as an initial foothold for further intrusion.

Detection Guidance

Sigma Rule

title: Suspicious DASYLab Execution Opening Untrusted DSB File
id: 8f3c2b1a-9d4e-4a7b-b6c2-1f0e3a5d9c77
status: experimental
description: Detects DASYLab process execution that opens a .dsb worksheet, especially from user-writable or external locations (inferred detection for CVE-2026-64195 OOB write).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-64195
author: Threat Intelligence
date: 2026/01/01
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\dasylab.exe'
  selection_path:
    CommandLine|contains:
      - '.dsb'
  condition: selection_parent and selection_path
fields:
  - CommandLine
  - ParentImage
  - Image
falsepositives:
  - Legitimate engineering usage of DASYLab opening trusted project files
level: low
tags:
  - attack.t1203
  - cve.2026.64195

YARA Rule

rule CVE_2026_64195_DASYLab_DSB_OOB
{
    meta:
        description = "Detects malformed DASYLab .DSB worksheet files potentially triggering CVE-2026-64195 out-of-bounds write"
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-64195"
        cve = "CVE-2026-64195"
    strings:
        $magic = "DSB" ascii wide
        $hdr1  = "DASYLab" ascii wide
        $hdr2  = "Worksheet" ascii wide
    condition:
        filesize < 50MB and
        (uint16(0) == 0x5344 or $magic at 0) and
        any of ($hdr*)
}

Note: Because no published file-format specification or PoC marker is available, this rule is heuristic — it flags DASYLab .DSB worksheet files for review rather than matching a known-bad byte pattern. It should be tuned against a baseline of legitimate files in the environment.

Suricata IDS Rule

alert tcp $HOME_NET any -> $HOME_NET any (msg:"CVE-2026-64195 Possible DASYLab .DSB File Transfer"; flow:established,to_server; fileext:"dsb"; filestore; classtype:attempted-user; reference:cve,2026-64195; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-64195; sid:202664195; rev:1;)

Elastic Detection

process where event.type == "start" and
  process.parent.name == "dasylab.exe" and
  process.command_line : "*.dsb*"

Splunk SPL Query

index=windows EventCode=4688
| eval cl=lower(CommandLine)
| where (like(ParentProcessName, "%dasylab.exe%") OR like(process_name, "%dasylab.exe%"))
        AND match(cl, "\.dsb")
| stats count values(CommandLine) as cmd by ComputerName, Account_Name, ParentProcessName
| sort - count

Wazuh OSSEC Rule

<group name="windows,application,cve_2026_64195,">
  <rule id="100641" level="6">
    <if_sid>61603</if_sid>
    <field name="win.eventdata.parentImage">(?i)dasylab\.exe$</field>
    <field name="win.eventdata.commandLine">(?i)\.dsb</field>
    <description>CVE-2026-64195: DASYLab opened a .dsb file - possible crafted worksheet exploitation attempt</description>
    <mitre>
      <id>T1203</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — a single source asserts a fix; not independently confirmed).

1. Immediate mitigations (when patching cannot be applied at once):

   • Treat .DSB files from untrusted or external sources as untrusted content. Do not open worksheet files received via email, removable media, shared drives, or file-sharing services unless the source is verified.
   • Restrict .DSB file association and inbound file transfer to trusted channels; consider application allow-listing that prevents unvetted users from launching DASYLab against unverified files.
   • Where feasible, open untrusted .DSB files in an isolated, non-networked environment (sandbox or dedicated analysis host) rather than on production engineering workstations.
   • Apply least-privilege principles so that a memory-corruption primitive cannot immediately escalate to broader system access.
   • Monitor endpoint telemetry for DASYLab processes opening .DSB files from unusual locations (temp, downloads, email attachment directories).

2. Patch / upgrade steps:

   • Upgrade NI DASYLab to version 2026.0.0 or later, which is the version referenced as containing the fix according to NVD. Verify the fix directly with the vendor because patch confidence is only 2/4 (single-source claim).
   • Confirm the installed DASYLab version through NI Package Manager or the product's About dialog before and after upgrading.
   • Re-test any internal .DSB automation pipelines against the updated version to ensure compatibility.

3. Long-term hardening:

   • Maintain a routine patch-management process for engineering and instrumentation software, which is often excluded from standard patch cycles.
   • Implement file-content inspection and email-attachment sandboxing that can detonate and analyze suspicious .DSB files before user delivery.
   • Segment engineering/OT workstations from general corporate networks to reduce the blast radius of workstation compromise and lateral movement.
   • Retain and review audit logs for file-open and process-execution events involving DASYLab to support post-incident investigation.

References

• NVD — CVE-2026-64195: https://nvd.nist.gov/vuln/detail/CVE-2026-64195
• CWE-787: Out-of-bounds Write — https://cwe.mitre.org/data/definitions/787.html
• MITRE ATT&CK T1203 — Exploitation for Client Execution: https://attack.mitre.org/techniques/T1203/
• NI (National Instruments) product security/patches page: https://www.ni.com/en/support/security.html
• FIRST EPSS — CVE-2026-64195 score lookup: https://api.first.org/data/v1/epss?cve=CVE-2026-64195

No threat-actor campaign or exploit-in-the-wild evidence is present in the provided intelligence. CISA KEV status is NO, and EPSS is 0.00158 (4.2% percentile). Public PoC is noted but no exploit code or Nuclei template is confirmed in the data set.