CVE-2026-64197

Executive Summary

CVE-2026-64197 is an out-of-bounds write (CWE-787) in NI DASYLab caused by improper validation of user-supplied data, allowing a write past the end of an allocated data structure when a victim opens a specially crafted .DSB file. All versions before 2026.0.0 are affected. With a CVSS 3.1 base score of 7.8 and complete compromise of confidentiality, integrity, and availability (C:H/I:H/A:H), successful exploitation can yield arbitrary code execution in the context of the user who opens the file, making this a high-severity client-side file-parsing flaw.

Technical Analysis

DASYLab is a graphical data acquisition, measurement, and signal-processing environment. Its project/worksheet files use the .DSB extension, which the application parses when a user opens a document. CVE-2026-64197 is an out-of-bounds write: the parser fails to properly validate user-supplied data derived from the .DSB file contents, and consequently performs a write operation past the end of an allocated heap (or adjacent) data structure.

The root cause class is CWE-787 (Out-of-bounds Write), which occurs when a program writes data beyond the boundaries of a fixed-length buffer or allocated memory region. The vulnerability is triggered by crafting a .DSB file whose contents — as parsed by DASYLab — cause incorrect size or offset calculations during deserialization/parsing of the file structure. Because the write goes past the end of the intended allocation, an attacker can corrupt adjacent heap metadata or function pointers, which is the classic prerequisite for memory-corruption-based code execution.

Attack surface characteristics:

• Delivery vector: Local file (AV:L) — the malicious .DSB file must be delivered to and opened by the victim.
• Attack complexity: Low (AC:L) — no race conditions or special environmental preconditions beyond crafting the file.
• Privileges required: None (PR:N) — the attacker does not need prior access to the target host, only the ability to deliver a file.
• User interaction: Required (UI:R) — the victim must open the crafted .DSB file.

The NVD description does not disclose the specific parsing function, offset field, or data structure involved. No public root-cause write-up, patch diff, or exploit code is identified in the supplied intelligence. The .DSB file is the sole, explicitly documented attack vector, and the write-past-end behavior is the sole, explicitly documented mechanism.

Exploitation Scenarios

The following chain is derived strictly from the NVD description and the associated vulnerability class. No public PoC is referenced in the supplied data; the technical steps below remain at the vulnerability-class level.

1. Reconnaissance / Targeting. The attacker identifies an environment where DASYLab is used (engineering labs, test benches, industrial measurement and data-acquisition workstations). These are typically high-value engineering endpoints with access to measurement networks and engineering data. The attacker does not need network access to the endpoint — only a delivery channel for the forged file.

   • Note: no Shodan-based server exposure applies here, as the vulnerability is triggered by a local file rather than a network service. Discovery is therefore driven by file-sharing, email, or removable media rather than internet scanning.

2. Weaponization / Payload Construction. The attacker crafts a .DSB file containing malformed data. Because the flaw is improper validation of user-supplied data, the malformed data is embedded in the file content in a way that causes DASYLab's parser to compute an incorrect destination location, resulting in a write beyond the end of an allocated data structure. The exact field that is not validated is not disclosed by the description, so the exploit is described at the class level: the attacker manipulates the .DSB structure to induce an out-of-bounds write during parsing/open.

3. Delivery / User Execution (T1204.002). The forged .DSB file is delivered via email attachment, shared network drive, chat, or removable media. The victim opens the file in DASYLab (the required user interaction). Upon opening, DASYLab parses the .DSB file and the out-of-bounds write is triggered, corrupting adjacent memory.

4. Post-Exploitation Impact. The out-of-bounds write enables memory corruption. Depending on heap layout and the attacker's control over the corrupted data, this can lead to arbitrary code execution within the security context of the DASYLab process — i.e., the privileges of the user who opened the file. Impact includes full loss of confidentiality (engineering measurement data, project files), integrity (tampering with measurements, project content, or the host), and availability (crashes or destruction of data). A simple denial-of-service (application crash) is also reliably achievable from the write past end of allocation.

No exploit code is identified in the supplied data, and no evidence of in-the-wild exploitation is available (CISA KEV: NO). The attack chain above is inferred from the documented mechanism (improper validation of user-supplied data in .DSB parsing leading to an out-of-bounds write).

Impact Assessment

• Confidentiality (High): Code execution in the user's context permits reading arbitrary files accessible to that user, including project data, measurement results, and potentially credentials.
• Integrity (High): An attacker can modify files, measurement data, or the application itself in memory. Memory corruption also enables code execution, permitting persistent tampering.
• Availability (High): Triggering the out-of-bounds write can crash DASYLab (denial of service), corrupt open project data, or render the workstation unusable for measurement tasks.
• Scope (Unchanged): The vulnerable component and impacted component are the same; however, as with any code-execution-capable memory corruption, the effective blast radius depends on the privileges of the DASYLab user.
• Blast radius: Limited to hosts where a user opens a malicious .DSB file. In engineering environments, such hosts frequently bridge measurement/control networks and corporate IT, so a single compromised workstation can serve as a pivot point.
• Exploitation likelihood: EPSS 0.00158 (≈4.2 percentile) indicates low observed exploitation activity. PoC status is "Public," but no exploit code was identified in the supplied data, and there is no KEV listing.

Detection Guidance

Sigma Rule

title: DASYLab Malicious DSB File Execution via Potential Out-of-Bounds Write
id: 2f0a3c1e-9b4d-4f7a-8c2e-6d5a1b7e9c10
status: experimental
description: |
  Detects execution of DASYLab (dasylab.exe) where a .DSB project file is opened
  from an untrusted or user-writable location. Relates to CVE-2026-64197,
  an out-of-bounds write triggered by opening a crafted .DSB file.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-64197
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1204.002
  - cve.2026-64197
logsource:
  category: process_creation
  product: windows
detection:
  selection_image:
    Image|endswith:
      - '\dasylab.exe'
  selection_cmdline:
    CommandLine|contains:
      - '.dsb'
      - '.DSB'
  selection_paths:
    CommandLine|contains:
      - '\Users\'
      - '\Downloads\'
      - '\AppData\'
      - '\Temp\'
      - '\Desktop\'
  condition: selection_image and selection_cmdline and selection_paths
falsepositives:
  - Legitimate users opening DASYLab projects stored in user profile directories
level: medium

YARA Rule

rule EXPL_CVE_2026_64197_DASYLab_DSB_OOBWrite
{
    meta:
        description = "Detects suspicious .DSB files consistent with CVE-2026-64197 out-of-bounds write trigger in NI DASYLab"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-64197"
        cve = "CVE-2026-64197"
        severity = "high"

    strings:
        $hdr1 = "DASYLab" ascii wide nocase
        $hdr2 = ".DSB" ascii wide nocase
        $tag1 = "Worksheet" ascii wide nocase
        $tag2 = "Module" ascii wide nocase
        $tag3 = "Layout" ascii wide nocase
        $mz = { 4D 5A }

    condition:
        uint32(0) != 0x5A4D and
        filesize < 50MB and
        any of ($hdr*) and
        any of ($tag*) and
        $mz
}

Suricata IDS Rule

alert smb any any -> any any (msg:"FILE-OFFICE NI DASYLab .DSB file transfer (CVE-2026-64197 potential exploit delivery)"; flow:established,to_server; app-layer-protocol:smb; content:".DSB"; nocase; filestore; sid:2026641970; rev:1; metadata:cve CVE-2026-64197, attack_target Client_Endpoint, confidence Medium;)

alert http any any -> any any (msg:"FILE-OFFICE NI DASYLab .DSB file download (CVE-2026-64197 potential exploit delivery)"; flow:established,to_client; http.response_body; content:".DSB"; nocase; filestore; sid:2026641971; rev:1; metadata:cve CVE-2026-64197, attack_target Client_Endpoint, confidence Medium;)

alert smtp any any -> any any (msg:"FILE-OFFICE NI DASYLab .DSB attachment via SMTP (CVE-2026-64197 possible phishing delivery)"; flow:established,to_client; content:"filename="; nocase; content:".DSB"; nocase; distance:0; classtype:trojan-activity; sid:2026641972; rev:1; metadata:cve CVE-2026-64197, confidence Low;)

Elastic Detection

process where event.type == "start" and
  process.name : "dasylab.exe" and
  process.args : "*.dsb" and
  (
    process.args : "*\\Users\\*" or
    process.args : "*\\Downloads\\*" or
    process.args : "*\\AppData\\*" or
    process.args : "*\\Temp\\*" or
    process.args : "*\\Desktop\\*"
  )

Splunk SPL Query

index=endpoint OR index=sysmon EventCode=1
| where match(lower(Image), "dasylab\\.exe$")
| where match(lower(CommandLine), "\.dsb")
| where (match(lower(CommandLine), "\\\\users\\\\")
    OR match(lower(CommandLine), "\\\\downloads\\\\")
    OR match(lower(CommandLine), "\\\\appdata\\\\")
    OR match(lower(CommandLine), "\\\\temp\\\\")
    OR match(lower(CommandLine), "\\\\desktop\\\\"))
| stats count min(_time) as first_seen max(_time) as last_seen
        values(CommandLine) as cmdlines
        by ComputerName, User, Image
| convert ctime(first_seen) ctime(last_seen)
| sort - last_seen

Wazuh OSSEC Rule

<group name="windows,cve-2026-64197,dasylab,">
  <rule id="100641970" level="10">
    <if_group>sysmon_event1</if_group>
    <field name="win.eventdata.image">dasylab\.exe$</field>
    <field name="win.eventdata.commandLine">\.dsb</field>
    <description>CVE-2026-64197: DASYLab opened a .DSB project file - possible out-of-bounds write exploitation attempt</description>
    <mitre>
      <id>T1204.002</id>
    </mitre>
    <group>cve_2026_64197,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 — CLAIMED. A single source (NVD) claims a fix in DASYLab 2026.0.0; this has not been independently confirmed. Verify the fixed version directly with NI before relying on it for closure.

1. Immediate mitigations

   • Treat .DSB files from external or untrusted sources as potentially malicious. Block or quarantine .DSB attachments at the email and web gateways where business need permits.
   • Restrict who can write to file shares, removable media, and download directories that feed DASYLab workstations.
   • Where DASYLab must open untrusted files, do so under a low-privilege account and in a sandboxed or isolated environment (VM/app container) with no access to production measurement networks.
   • Monitor for DASYLab crashes or unusual memory-corruption behavior; repeated application crashes on opening a .DSB file are a potential exploitation indicator.

2. Patch / upgrade steps

   • Upgrade DASYLab to 2026.0.0 or later. Confirm the fixed build and release notes with NI, since the patch claim is single-source and unverified.
   • Maintain an inventory of DASYLab installations and versions; identify any endpoints running builds prior to 2026.0.0.
   • After upgrade, re-test representative .DSB projects to verify normal operation.

3. Long-term hardening

   • Adopt application allow-listing and endpoint detection on engineering workstations running DASYLab.
   • Segment measurement/engineering networks from corporate IT to limit pivot potential if a workstation is compromised.
   • Require file-provenance controls (e.g., content disarm and reconstruction, macro/embedded object stripping where compatible) for files entering engineering environments.
   • Track NI security advisories and subscribe to vendor notifications for future DASYLab memory-safety fixes.

References

• NVD — CVE-2026-64197: https://nvd.nist.gov/vuln/detail/CVE-2026-64197
• CWE-787 — Out-of-bounds Write: https://cwe.mitre.org/data/definitions/787.html
• MITRE ATT&CK T1204.002 — User Execution: Malicious File: https://attack.mitre.org/techniques/T1204/002/
• NI (National Instruments) product security advisories: https://www.ni.com/en/support/security.html
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-64197 not listed as of reporting): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor campaigns / exploit-in-the-wild evidence: None identified in the supplied intelligence. CISA KEV: NO. EPSS 0.00158 (≈4.2 percentile). No exploit code identified; public PoC status is reported as "Public," but no PoC artifact was provided or verified.