CVE-2026-64199

Executive Summary

CVE-2026-64199 is an out-of-bounds read (CWE-125) in NI DASYLab caused by improper validation of user-supplied data, resulting in reads outside the bounds of an allocated data structure. Exploitation requires a user to open a specially crafted .DSB file, making it a file-format, client-side vulnerability affecting all DASYLab versions prior to 2026.0.0. Although the CVSS base score is 7.8 (High) and the vector reflects High confidentiality and integrity impact, the OOB read primitive described is most directly a memory-disclosure/information-leak issue; the elevated integrity/availability sub-scores in the NVD vector should be treated as upper-bound environmental scoring rather than a confirmed write or code-execution primitive, given no public PoC or exploit code exists and EPSS is only 0.00157 (4.1% percentile).

Technical Analysis

DASYLab is a data acquisition, visualization, and control software package for Windows, historically distributed by National Instruments (NI). The vulnerability is an out-of-bounds read driven by improper validation of user-supplied data. The attack surface is the .DSB file format — a DASYLab worksheet/configuration file that the application parses when a user opens it. When the application processes a malformed .DSB file, it fails to validate length/index/offset fields before dereferencing them against an allocated data structure. The result is a read outside the bounds of that buffer (CWE-125).

At the vulnerability-class level, OOB reads typically arise when:

• A length or count field embedded in the file is trusted and used to compute an access offset or loop bound without a bounds check against the actual allocation size.
• An index or offset value is read from the file and used to dereference a pointer or array element without verifying it falls within the allocated region.
• A structure field is consumed before its declared size is validated against remaining buffer space.

The NVD description does not disclose the specific parser component, function name, structure name, or field offset involved. No function names, class names, file paths, or parameters beyond the .DSB file extension are provided by the CNA or NVD. Accordingly, no code-level detail can be asserted here beyond the vulnerability class and the general mechanism of untrusted-input-driven buffer over-read.

Out-of-bounds reads of this type commonly lead to disclosure of adjacent heap/stack memory, which may contain pointers, configuration data, or other in-process material that can defeat ASLR and inform a chained exploit. In some cases an OOB read on a large enough out-of-bounds region can also cause an access violation, resulting in a crash (availability impact), which is consistent with the High availability sub-score. However, whether CVE-2026-64199 can be converted into reliable code execution is not established by the available data — the CVSS vector assigns High confidentiality and integrity impact, but this should not be read as confirmation of a writable primitive or successful exploitation path.

Attack prerequisites are significant: the vector specifies AV:L (Local), UI:R (User Interaction Required), and PR:N (No Privileges Required). The attacker cannot trigger the flaw remotely through a service or network listener; they must deliver a malicious .DSB file and convince a user to open it. This is the classic file-format client-side exploitation model, similar in delivery mechanics to document-based malware, even though the underlying flaw is memory safety rather than scripting.

Exploitation Scenarios

No public PoC or exploit code is available for CVE-2026-64199. The attack chain below is inferred from the vulnerability class (CWE-125, OOB read via malformed file parsing) and the NVD description; it does not rely on any undocumented function, endpoint, or parameter names.

1. Reconnaissance / target identification. The attacker identifies organizations that use NI DASYLab for data acquisition and control — typically engineering, test & measurement, automotive, aerospace, and industrial R&D environments. There is no network-reachable service to scan; instead, the attacker profiles targets through document/file-sharing channels, email, and collaboration platforms where engineering teams exchange .DSB worksheets and configuration files. Basic Shodan queries against publicly exposed DASYLab-related web interfaces may aid in identifying environments where DASYLab is deployed, but the exploitable surface is the file, not the service.

2. Triggering the flaw class. The attacker crafts or modifies a .DSB file such that user-supplied data within the file — length, offset, or index-style fields that DASYLab parses — is malformed or manipulated so that it no longer corresponds to the bounds of the allocated data structure it is used against. When the victim opens the crafted .DSB file in a vulnerable DASYLab version (< 2026.0.0), the application parses the malicious structure and performs a read past the end (or before the beginning) of the allocated buffer.

3. Payload/execution method. The exploitation primitive is a malformed file opened by a user; the malformed fields themselves constitute the payload. No shellcode, scripting, or command injection is described. The realistic outcomes are (a) disclosure of out-of-bounds memory contents returned through application behavior, or (b) an access violation crashing the process. If the out-of-bounds read is reachable with attacker-controlled offset/length, it could be leveraged to leak memory contents — for example, adjacent heap data — which could serve as an information-disclosure primitive. Any progression from leak to code execution would require an additional, unidentified memory-corruption primitive and is not supported by the available data.

4. Post-exploitation impact. Based strictly on the flaw class and vector: potential disclosure of process memory (Confidentiality: High), possible corruption/manipulation of interpreted data resulting from the read (Integrity: High as scored), and potential application crash/denial of service (Availability: High as scored). Because user interaction is required and delivery is file-based, exploitation is high-effort and targeted rather than wormable or opportunistic. There is no evidence of in-the-wild exploitation, no CISA KEV listing, and no known threat actor campaign associated with this CVE.

Impact Assessment

• Base score: 7.8 (High). Confidentiality/Integrity/Availability all rated High (C:H/I:H/A:H).
• Attack vector: Local (AV:L) — the attacker needs the victim to open a file; no remote network vector.
• Attack complexity: Low (AC:L) — no race or specialized conditions are described.
• Privileges required: None (PR:N) — opening a file does not require elevated privileges; any user with DASYLab installed can trigger parsing.
• User interaction: Required (UI:R) — successful exploitation hinges on the victim opening the crafted .DSB file.
• Scope: Unchanged (S:U) — impact is confined to the DASYLab process/environment.

Business impact is concentrated in engineering and test-and-measurement environments: DASYLab workstations often sit close to lab instrumentation, data acquisition hardware, and engineering data, and may hold credentials or configuration for connected systems. A memory-disclosure outcome could expose sensitive engineering data or in-process memory; a crash outcome could interrupt measurement, test, or control workflows. Blast radius is limited to individual user workstations that open the malicious file — it is not a pivot-capable, service-side vulnerability. EPSS 0.00157 (4.1% percentile) indicates low predicted exploitation activity in the near term, but the specificity of required user interaction (opening a .DSB) means targeted, social-engineering-driven use against a narrow victim pool should not be dismissed merely because of the low EPSS value.

Detection Guidance

Sigma Rule

title: Suspicious DASYLab DSB File Open by Non-Standard Parent Process
id: 8f2c1b7a-3d4e-4a91-9c1e-64199dasy001
status: experimental
description: Detects DASYLab process spawning or opening .DSB worksheets outside normal interactive usage, potentially indicating exploitation of CVE-2026-64199 (OOB read in .DSB parsing).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-64199
author: Threat Intelligence
date: 2026/01/01
tags:
  - attack.t1203
logsource:
  category: process_creation
  product: windows
detection:
  selection_process:
    Image|endswith:
      - '\dasylab.exe'
      - '\DASYLab.exe'
  selection_dsb:
    CommandLine|contains: '.DSB'
  filter_signed_parent:
    ParentImage|endswith:
      - '\explorer.exe'
      - '\outlook.exe'
      - '\winrar.exe'
      - '\7zFM.exe'
  condition: selection_process and selection_dsb and not filter_signed_parent
falsepositives:
  - Legitimate automation scripts launching DASYLab with .DSB files
level: medium

YARA Rule

rule CVE_2026_64199_DASYLab_DSB_OOB_Read
{
    meta:
        description = "Heuristic detection of malformed DASYLab .DSB worksheet files potentially triggering CVE-2026-64199 out-of-bounds read"
        author = "Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-64199"
        date = "2026-01-01"
        severity = "high"

    strings:
        $dsb_magic1 = { 44 53 42 }          // "DSB"
        $dsb_magic2 = "DASYLab"
        $dsb_ws     = "Worksheet"
        $mz         = { 4D 5A }

    condition:
        (uint16(0) != 0x5A4D) and
        filesize < 10MB and
        (
            $dsb_magic1 at 0 or
            ($dsb_magic2 and $dsb_ws)
        ) and
        not $mz
}

Note: This is a heuristic file-identification rule; no publicly documented malicious byte pattern exists for this CVE, so the rule keys on the .DSB file identification rather than a confirmed exploit signature.

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-64199 Potential DASYLab DSB File Transfer (Client-Side OOB Read Vector)"; flow:established,to_client; fileext:"DSB"; filestore; sid:202664199; rev:1; metadata:affected_product DASYLab, cve CVE-2026-64199, mitre_tactic_id T1203; classtype:attempted-user; priority:3;)

Note: CVE-2026-64199 has no network-triggerable vector. Network monitoring can only observe transport of .DSB files to a user, which is a delivery-stage indicator, not exploit traffic.

Elastic Detection

process where event.type == "start" and
  process.name in ("dasylab.exe", "DASYLab.exe") and
  process.command_line : "*.DSB*" and
  not process.parent.name in ("explorer.exe", "outlook.exe", "winrar.exe", "7zFM.exe")

Splunk SPL Query

index=windows sourcetype=WinEventLog:Security (EventCode=1 OR EventCode=4688)
| search (Image="*\\dasylab.exe" OR Image="*\\DASYLab.exe")
| search (CommandLine="*.DSB*" OR CommandLine="*.dsb*")
| stats count min(_time) as first_seen max(_time) as last_seen
        values(ParentImage) as parent values(User) as user
        by ComputerName, Image, CommandLine
| where count > 0
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"),
       last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
| sort - count

Wazuh OSSEC Rule

<group name="windows,cve-2026-64199,memory_corruption,">
  <rule id="100641" level="10">
    <if_sid>60000</if_sid>
    <field name="win.eventdata.image">(?i)dasylab\.exe$</field>
    <field name="win.eventdata.commandLine">(?i)\.DSB</field>
    <description>CVE-2026-64199: DASYLab launched with .DSB worksheet file - possible malicious file open</description>
    <mitre>
      <id>T1203</id>
    </mitre>
    <group>cve_2026_64199,</group>
  </rule>
</group>

Note: These detection rules cover the delivery/execution stage of the client-side attack chain. Because no public exploit signature or PoC exists, they cannot be validated against confirmed malicious samples and should be tuned to reduce false positives from legitimate engineering workflows.

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch; not independently confirmed). NVD states the issue affects all versions before 2026.0.0, and the fix reference is attributed to NVD as the sole source. No vendor advisory URL, KB article, or independent confirmation was provided in the intelligence data, so patch status should be verified directly with the vendor before relying on it.

1. Immediate mitigations

• Restrict acceptance of .DSB files from untrusted sources. Treat inbound .DSB workbooks with the same caution as macro-bearing documents: block or quarantine at email gateways and file-sharing platforms where operationally feasible.
• Apply Mark-of-the-Web / attachment policies so files received externally inherit restricted handling.
• If DASYLab is not required on a given workstation, remove it to eliminate the attack surface.
• Where possible, run DASYLab under a least-privileged account and isolate lab/engineering workstations from general corporate network segments to reduce the value of any memory-disclosure outcome.

2. Patch / upgrade steps

• Upgrade DASYLab to 2026.0.0 or later, the version identified as containing the fix, after confirming availability and applicability with the vendor. Because the patch claim is single-source, validate the release notes and CVE mapping directly with the vendor before deployment.
• Inventory all hosts running DASYLab and prioritize upgrade for systems that routinely open external .DSB files.

3. Long-term hardening

• Establish a formal policy for opening third-party project/worksheet files in engineering tools; pre-screen or sandbox them where possible.
• Add application-level exploit mitigations (e.g., OS exploit protection / mandatory ASLR and DEP settings) to reduce the impact of memory-safety defects if a future flaw is triggered.
• Monitor vendor advisories and NVD for updates to CVE-2026-64199, including any emergence of PoC or exploit-in-the-wild evidence, and re-evaluate EPSS over time.
• Maintain asset inventory coverage for engineering/data-acquisition software, which is frequently omitted from standard vulnerability management scopes.

References

• NVD — CVE-2026-64199: https://nvd.nist.gov/vuln/detail/CVE-2026-64199
• CWE-125 — Out-of-bounds Read: https://cwe.mitre.org/data/definitions/125.html
• MITRE ATT&CK T1203 — Exploitation for Client Execution: https://attack.mitre.org/techniques/T1203/
• National Instruments (NI) DASYLab product and support resources: https://www.ni.com/
• FIRST EPSS — CVE-2026-64199 scoring: https://www.first.org/epss/

Threat actor campaign evidence: None identified. No public PoC, no exploit code, no Nuclei template, and no CISA KEV listing exist for CVE-2026-64199 at the time of writing.