CVE-2026-64200

Executive Summary

CVE-2026-64200 is an out-of-bounds read vulnerability (CWE-125) in National Instruments' DASYLab data acquisition and analysis software, caused by improper validation of user-supplied data during string conversion. A heap buffer over-read occurs when the application parses a malformed .DSB project file, and successful exploitation requires a user to open a specially crafted file. The CVSS score of 7.8 reflects high confidentiality, integrity, and availability impact, though exploitation demands local interaction (user opening the file) rather than remote, unauthenticated access.

Technical Analysis

DASYLab stores its project/worksheet configuration in .DSB files, which are binary containers that embed structured data including text strings (worksheet names, channel labels, module parameters, script fragments). CVE-2026-64200 stems from improper validation of user-supplied data during a string conversion routine. When DASYLab reads length-prefixed or delimited string fields from a .DSB file, it fails to verify that the declared or inferred length is consistent with the actual size of the allocated heap buffer holding that data.

The result is an out-of-bounds read past the end of an allocated heap buffer. The application walks the buffer beyond its valid boundary while attempting to convert or interpret the string data, which can cause the parser to read adjacent heap memory. This class of bug — an out-of-bounds read in CWE-125 — typically produces one or more of the following outcomes:

• Information disclosure: Data from adjacent heap allocations (which may contain pointers, structure metadata, or residual string content) is read and potentially surfaced through the application's parsing behavior or a resulting memory error message.
• Availability impact: The malformed access frequently leads to a crash or abnormal termination when the over-read crosses an unmapped page boundary, which maps to the CVSS availability impact of High.
• Memory corruption primitives: Because the CVSS vector assigns High integrity (I:H) and High confidentiality (C:H) alongside High availability, the flaw may be reachable through a parsing path where the over-read is combined with subsequent buffer handling, allowing the adjacent read to influence control flow or corrupt state — a common escalation from an OOB read when the resulting data is reused. The exact mechanism by which integrity impact is achieved is not detailed in the available description, and no public proof-of-concept exists to confirm the precise control-flow path.

The attack surface is the local file-open operation. The vulnerability is not remotely reachable through a network service; the vector AV:L (Local) with UI:R (User Interaction Required) confirms that an attacker must deliver the malicious .DSB file to the victim and rely on the victim opening it in DASYLab. The AC:L (Attack Complexity: Low) rating indicates no specialized conditions or race windows are required — the malformed file deterministically triggers the flaw on a vulnerable version.

No specific function names, source files, or parsing routine identifiers are available from the NVD description or CNA data. The vulnerability class — OOB read during string conversion of unvalidated data from a proprietary project file — is the extent of what can be stated with confidence.

Exploitation Scenarios

No public proof-of-concept, Nuclei template, or exploit code is available for CVE-2026-64200. The attack chain below is inferred strictly from the vulnerability class (CWE-125, out-of-bounds read on unvalidated .DSB file data) and the CVSS vector. It does not rely on any fabricated implementation details.

1) Reconnaissance / target identification. An adversary identifies engineering, test, or manufacturing environments where DASYLab is deployed, typically in electrical measurement, automotive test benches, sensor validation, and industrial R&D labs. These environments frequently exchange .DSB project files between engineers, external contractors, and field teams, providing a credible delivery pretext. The attacker confirms a target version prior to 2026.0.0.

2) Delivery and trigger. The attacker crafts a .DSB file containing a malformed string field whose declared or delimited length does not match the data actually present, causing the vulnerable conversion routine to read past the end of its heap buffer. Delivery is via social engineering — email attachment, shared engineering repository, USB media, or file-share — and exploitation succeeds only when the victim opens the file in DASYLab (consistent with UI:R).

3) Payload / execution at the vulnerability-class level. When DASYLab parses the crafted .DSB string during project load, the improper length validation allows the string conversion to read beyond the allocated heap buffer. No specific code pattern is asserted here because none is disclosed. The observable effect of the primary flaw is an out-of-bounds heap read during string conversion.

4) Post-exploitation impact. Depending on the memory context adjacent to the over-read buffer, outcomes range from information disclosure (reading neighboring heap contents) to application crash (availability), with the CVSS vector additionally indicating potential integrity impact. Because exploitation requires local file interaction and there is no network vector, the primary initial-access value of this CVE is in phishing/social-engineering campaigns against DASYLab users, not in wormable or remote mass exploitation. An attacker who achieves reliable code execution through associated memory corruption would inherit the privileges of the DASYLab process on the victim workstation.

Note: No exploit-in-the-wild evidence, CISA KEV listing, or threat actor attribution exists for this CVE at the time of writing.

Impact Assessment

• Confidentiality (High): An out-of-bounds heap read can expose adjacent memory contents, potentially leaking sensitive engineering data, pointers, or residual in-memory strings.
• Integrity (High): The CVSS vector assigns High integrity, indicating the flaw class can affect data or control state in the vulnerable process; the precise mechanism is not documented in available sources.
• Availability (High): Malformed string parsing commonly crashes the application, disrupting test benches or measurement runs.
• Blast radius: Local to the workstation running DASYLab. No server-side or network-wide propagation is indicated by the AV:L vector. Impact scales with how widely .DSB project files are shared within the organization — each engineer opening a shared project file is an independent trigger opportunity.
• Business impact: DASYLab is used in validation and measurement workflows where a crash mid-test can invalidate a run, and where .DSB files may contain proprietary test configurations. Compromise of an engineering workstation may serve as a foothold in OT-adjacent or R&D networks that are often less instrumented than corporate IT.
• EPSS 0.00158 (4.2th percentile): Very low predicted exploitation activity in the wild, consistent with the local, user-interaction-gated attack model and the absence of public exploit code.

Detection Guidance

Sigma Rule

title: DASYLab Process Crash or Exploit Indicator on DSB File Open (CVE-2026-64200)
id: 8f3c2a91-0e4d-4b7a-9c2e-1a6b5d3f7e20
status: experimental
description: Detects process creation or crash behavior consistent with malicious .DSB file handling by DASYLab where an out-of-bounds read may occur during string conversion.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-64200
author: Threat Intelligence
date: 2026/01/01
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\dasylab.exe'
      - '\dasylab64.exe'
  selection_ext:
    CommandLine|contains:
      - '.dsb'
      - '.DSB'
  condition: selection_img and selection_ext
fields:
  - Image
  - CommandLine
  - User
  - ParentImage
falsepositives:
  - Legitimate DASYLab project files opened normally
level: low
tags:
  - attack.t1204.002
  - cve.2026.64200

YARA Rule

rule EXPL_CVE_2026_64200_DASYLab_DSB_OOBRead
{
    meta:
        author = "Threat Intelligence"
        description = "Heuristic detection of potentially malformed DASYLab .DSB project files associated with CVE-2026-64200 out-of-bounds read during string conversion."
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-64200"
        date = "2026-01-01"
        cve = "CVE-2026-64200"
        severity = "high"

    strings:
        $dsb_magic = { 44 53 42 }        // "DSB" ASCII marker (heuristic)
        $dsb_ext   = ".dsb" ascii nocase

    condition:
        $dsb_magic at 0 or $dsb_ext
}

Note: Because no public sample of the malicious .DSB structure is available, this rule is a file-type heuristic rather than a signature-based detection. It flags .DSB files for analyst triage; it will not reliably distinguish benign from malicious content on its own.

Suricata IDS Rule

alert tcp $HOME_NET any -> $HOME_NET any (msg:"FILE-STORAGE Possible DASYLab .DSB malicious project file transfer (CVE-2026-64200)"; flow:established,to_client; fileext:"dsb"; filestore; sid:9004200; rev:1; metadata:affected_product DASYLab, cve CVE-2026-64200, created_at 2026_01_01; classtype:attempted-user;)

Because there is no network exploitation vector, this rule only flags delivery of .DSB files in transit for downstream inspection. There is no HTTP-based signature to write since the vulnerability is not remotely triggered.

Elastic Detection

process where event.type == "start" and
  process.name : ("dasylab.exe", "dasylab64.exe") and
  process.args : "*.DSB"

Additionally, monitor for abnormal termination of DASYLab processes coincident with .DSB file opens:

process where event.type == "stop" and
  process.name : ("dasylab.exe", "dasylab64.exe") and
  process.exit_code != 0

Splunk SPL Query

index=endpoint (Image="*\\dasylab.exe" OR Image="*\\dasylab64.exe") CommandLine="*.dsb*"
| stats count min(_time) as first_seen max(_time) as last_seen by host, User, Image, CommandLine
| convert ctime(first_seen) ctime(last_seen)
| sort - last_seen

Wazuh OSSEC Rule

<group name="dasylab,cve-2026-64200,">
  <rule id="100420" level="6">
    <if_sid>59200</if_sid>
    <field name="win.eventdata.image">dasylab</field>
    <field name="win.eventdata.commandLine">\.dsb</field>
    <description>DASYLab opened a .DSB project file - possible CVE-2026-64200 trigger; triage file origin</description>
    <mitre>
      <id>T1204.002</id>
    </mitre>
  </rule>

  <rule id="100421" level="10">
    <if_sid>60009</if_sid>
    <field name="win.eventdata.image">dasylab</field>
    <description>DASYLab process crash following project file open - potential CVE-2026-64200 exploitation</description>
    <mitre>
      <id>T1204.002</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch, not independently confirmed). The fix is reported as available in DASYLab 2026.0.0, but that claim rests on a single source (NVD) and has not been independently verified. Treat as unconfirmed until the vendor advisory is located.

1) Immediate mitigations

• Upgrade DASYLab to version 2026.0.0 or later, where the defect is claimed fixed. Validate the patch against the vendor's official release notes before relying on it.
• Until upgrade is verified, treat all inbound .DSB files as untrusted. Block or quarantine .DSB attachments at the email gateway and file-sharing layer.
• Enforce a policy requiring .DSB projects to be sourced only from vetted internal repositories; prohibit opening project files received from external parties.
• Run DASYLab under a least-privilege account and consider application sandboxing/AppContainer or endpoint isolation to limit impact of any memory-corruption escalation.
• Enable exploit-protection mitigations (ASLR, DEP, and where feasible CFG) for the DASYLab process.

2) Patch / upgrade steps

• Obtain the DASYLab 2026.0.0 installer only from National Instruments' official distribution channels and verify its signature/hash.
• Confirm patch applicability across all affected versions (all releases prior to 2026.0.0 are listed as vulnerable).
• Re-test representative existing .DSB project files after upgrade to confirm no regression in legitimate parsing.

3) Long-term hardening

• Maintain an inventory of DASYLab installations and versions across engineering and R&D endpoints.
• Integrate file-origin awareness into engineering workflow: sign internal .DSB files, verify provenance before opening.
• Monitor for crashes of measurement/analysis applications as a potential exploitation signal, and correlate with recent file access.
• Track the vendor for an authoritative security advisory to upgrade the patch-confidence assessment from CLAIMED to CONFIRMED.

References

1. NVD — CVE-2026-64200: https://nvd.nist.gov/vuln/detail/CVE-2026-64200
2. MITRE CWE-125 — Out-of-bounds Read: https://cwe.mitre.org/data/definitions/125.html
3. NI (National Instruments) DASYLab product and release information: https://www.ni.com/en/shop/data-acquisition-and-control/dasylab.html
4. MITRE ATT&CK T1204.002 — Malicious File: https://attack.mitre.org/techniques/T1204/002/
5. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-64200 is NOT listed as of this writing; no exploit-in-the-wild evidence or threat actor campaign is associated with this CVE).