CVE-2026-64198

Executive Summary

CVE-2026-64198 is an out-of-bounds read vulnerability (CWE-125) in NI DASYLab, a data acquisition and analysis software suite. The flaw stems from improper validation of user-supplied data and is triggered when a user opens a specially crafted .DSB file, causing a read of a few bytes past the end of an allocated heap buffer. Although the CVSS vector indicates a local attack vector with user interaction required, the confidentiality, integrity, and availability impacts are all rated High, and the vulnerability affects all versions prior to 2026.0.0.

Technical Analysis

The vulnerability is classified as CWE-125 (Out-of-bounds Read). According to the NVD description, DASYLab processes user-supplied data from .DSB files without adequate validation. When a malformed or specially crafted .DSB file is loaded, the application reads beyond the boundaries of an allocated heap buffer by a few bytes. This behavior indicates that a length or offset field within the file structure is trusted and used for pointer arithmetic or buffer indexing without sufficient bounds checking relative to the actual allocation size.

The attack surface is the file parsing component responsible for reading the .DSB format. Because the required attacker position is local (AV:L) and user interaction (UI:R) is required, exploitation depends on a victim opening a malicious file, typically delivered via phishing, file sharing, or a web download. The PR:N (No Privileges Required) subscore means the attacker does not need any prior authentication on the target system — only the ability to place the file for the victim to open. The S:U (Unchanged) scope indicator means the exploit cannot, by itself, affect resources beyond the vulnerable component's security authority. However, the C:H/I:H/A:H ratings indicate that successful exploitation can result in full loss of confidentiality, integrity, and availability for the vulnerable component, aligning with the potential for memory corruption that may lead to code execution or a persistent denial of service.

No further code-level detail (specific functions, parsing routines, or memory allocation patterns) is provided in the available data. The mechanism is therefore described at the class level: an out-of-bounds read resulting from improper validation of a length or index derived from file content.

Exploitation Scenarios

No public exploit code or PoC is available in the provided data (PoC status listed as Public, but no Exploit Code or Nuclei template confirmed; the reported "Public" PoC status may refer to a proof-of-concept in a vendor advisory or researcher disclosure, but no code is available for analysis). The following attack chain is inferred from the vulnerability class (CWE-125) and the NVD description.

1. Reconnaissance / Target Identification: The attacker identifies systems running NI DASYLab versions prior to 2026.0.0. These are typically engineering workstations, laboratory data acquisition systems, or industrial test benches within OT/engineering environments. The attacker may obtain this information via public references, network scanning for Windows hosts with DASYLab installed, or social engineering that reveals the target's software stack.

2. Crafting the Malicious File: The attacker creates a .DSB file with manipulated fields that dictate a buffer length or read offset larger than the actual allocated buffer. The file is designed to trigger the parser to read past the end of a heap allocation by a few bytes. The exact structure of the .DSB file is proprietary to NI, and no public specification is included in the available data.

3. Delivery and Triggering: The attacker delivers the file to the victim, for example through a phishing email attachment, a link to a shared file, or a USB drive. The victim is required to open the .DSB file with DASYLab. Upon parsing, the application reads out-of-bounds memory, which may cause a crash (availability impact) or, depending on the memory layout and adjacent data, could leak sensitive information from the heap (confidentiality impact). In some scenarios, the out-of-bounds read could be a precursor to further exploitation, but the NVD description explicitly labels this as a read, not a write.

4. Post-Exploitation Impact: The immediate effect is a read of a few bytes past the end of an allocated buffer. This may result in abnormal termination (crash) of the DASYLab process, leading to loss of availability for the application. If the leaked memory contains sensitive data, it could be exposed through crash dumps or error messages. While CVSS rates confidentiality, integrity, and availability as High, the out-of-bounds read alone does not directly provide code execution or integrity modification; those ratings likely reflect the potential for secondary effects or the worst-case scenario defined by the CNA. No public evidence of weaponization or in-the-wild exploitation is available.

Impact Assessment

The business impact of CVE-2026-64198 is concentrated on organizations that rely on NI DASYLab for data acquisition, test automation, and measurement workflows. Affected systems are typically engineering workstations in R&D, manufacturing test, and laboratory environments. Because the vulnerability requires local access and user interaction, the blast radius is limited to individual workstations where a user opens a malicious .DSB file. However, in OT/engineering networks, a single compromised workstation may serve as a pivot point or cause disruption to test and measurement operations.

The CVSS v3.1 base score is 7.8 (High), with the following subscores:

• Confidentiality (C:H): The out-of-bounds read may expose sensitive data from heap memory, including potentially project data, credentials, or other process memory.
• Integrity (I:H): Although the flaw is a read, the CVSS rating indicates potential integrity impacts, possibly due to the nature of the parsing error or secondary effects.
• Availability (A:H): A malformed file can cause the application to crash, leading to denial of service for the DASYLab instance.
• Attack Vector (AV:L): Exploitation requires local access, meaning the attacker must deliver the file to the target system and the user must execute it.
• User Interaction (UI:R): The victim must open the crafted .DSB file.
• Privileges Required (PR:N): No authentication is needed; any user who can open a file can trigger the flaw.
• Scope (S:U): The impact is confined to the vulnerable component.

The EPSS score is 0.00158 (4.2nd percentile), indicating a low probability of exploitation in the wild within the next 30 days. The vulnerability is not listed in CISA KEV, and no known threat actor campaigns are associated with it at this time. The primary risk is to targeted attacks against high-value engineering environments where DASYLab is used.

Detection Guidance

Sigma Rule

title: Out-of-Bounds Read in NI DASYLab via Crafted .DSB File
id: 7f8a3c2e-1b4d-4a6f-9e2c-8d5f1a3b7c9e
status: experimental
description: Detects attempts to exploit CVE-2026-64198 by monitoring for DASYLab process crashes or abnormal termination when opening .DSB files.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-64198
author: valtersit.com
date: 2026-01-01
tags:
    - attack.t1203
    - cve.2026.64198
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\DASYLab.exe'
        CommandLine|contains: '.DSB'
    condition: selection
falsepositives:
    - Legitimate DASYLab usage opening .DSB files
level: medium

YARA Rule

rule CVE_2026_64198_DASYLab_DSB_OOB_Read
{
    meta:
        description = "Detects malformed .DSB files that may trigger out-of-bounds read in NI DASYLab (CVE-2026-64198)"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-64198"
        hash = "unknown"
    strings:
        $dsb_magic = { 44 53 42 00 } // "DSB" magic header, hypothetical; adjust to actual format
        $dsb_ext = ".DSB" nocase
    condition:
        $dsb_ext at 0 or $dsb_magic at 0
}

Suricata IDS Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-64198 NI DASYLab .DSB File Download Attempt"; flow:to_client,established; fileext:"DSB"; classtype:attempted-user; sid:10000001; rev:1;)

Elastic Detection

process where process.name == "DASYLab.exe" and process.args : "*.DSB"

Splunk SPL Query

index=windows EventCode=1 Image="*\\DASYLab.exe" CommandLine="*.DSB*"
| table _time, host, user, CommandLine, ParentImage

Wazuh OSSEC Rule

<group name="windows,cve-2026-64198,">
  <rule id="100001" level="10">
    <if_sid>61603</if_sid>
    <field name="win.eventdata.image">DASYLab\.exe</field>
    <field name="win.eventdata.commandLine">\.DSB</field>
    <description>CVE-2026-64198: Potential exploitation attempt - DASYLab opening .DSB file</description>
    <mitre>
      <id>T1203</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch (not independently confirmed)).

1. Immediate Mitigations:

   • Avoid opening .DSB files from untrusted sources. Implement email and web gateway filtering to block or quarantine .DSB attachments.
   • Restrict user permissions to prevent execution of DASYLab from unexpected locations.
   • Monitor for abnormal DASYLab process crashes, which may indicate exploitation attempts.
   • Apply the principle of least privilege to engineering workstations to limit the impact of a successful exploit.
   • If DASYLab is not required, consider uninstalling it or disabling its file associations.

2. Patch/Upgrade Steps:

   • The NVD description states that all versions before 2026.0.0 are affected. A patch is claimed in version 2026.0.0. Verify the availability of this version from NI's official download portal or support channels.
   • Before upgrading, back up DASYLab projects and configuration. Test the upgrade in a non-production environment.
   • After upgrading, confirm the version number in the application's About dialog or via file properties.

3. Long-term Hardening:

   • Implement application allowlisting to ensure only approved versions of DASYLab execute.
   • Enable exploit protection features such as Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR) at the OS level; these may not prevent the read but can complicate secondary exploitation.
   • Conduct regular vulnerability scanning and patch management for engineering software.
   • Train users to recognize phishing and social engineering attempts that deliver malicious files.
   • Monitor NI security advisories for updates on CVE-2026-64198 and related issues.

References

• NVD – CVE-2026-64198: https://nvd.nist.gov/vuln/detail/CVE-2026-64198
• NI Security Advisory (vendor advisory pending; check NI's security page for updates)
• CWE-125: Out-of-bounds Read – https://cwe.mitre.org/data/definitions/125.html
• MITRE ATT&CK T1203: Exploitation for Client Execution – https://attack.mitre.org/techniques/T1203/
• EPSS Score for CVE-2026-64198 – https://api.first.org/data/v1/epss?cve=CVE-2026-64198

No known threat actor campaigns or exploit-in-the-wild evidence are available at this time. The EPSS score (0.00158) and absence from CISA KEV indicate a low likelihood of active exploitation.