CVE-2026-0954: NI DASYLab RCE Vulnerability

CVE-2026-0954 Overview

A memory corruption vulnerability exists in Digilent DASYLab due to an out-of-bounds write condition when processing corrupted DSB files. This security flaw allows attackers to corrupt memory beyond allocated boundaries, potentially leading to information disclosure or arbitrary code execution on targeted systems.

The vulnerability is triggered when a user opens a specially crafted .DSB file, making it a prime candidate for social engineering attacks where malicious files could be distributed via email, file sharing platforms, or compromised download sources.

Critical Impact

Successful exploitation enables arbitrary code execution with the privileges of the current user, potentially allowing complete system compromise through a malicious DSB file.

Affected Products

• Digilent DASYLab (all versions)
• NI DASYLab data acquisition laboratory software
• Systems processing untrusted .DSB project files

Discovery Timeline

• 2026-03-13 - CVE-2026-0954 published to NVD
• 2026-03-19 - Last updated in NVD database

Technical Details for CVE-2026-0954

Vulnerability Analysis

This vulnerability falls under CWE-787 (Out-of-Bounds Write), a memory corruption class that occurs when software writes data past the end or before the beginning of the intended buffer. In the context of Digilent DASYLab, the vulnerability manifests during the parsing and loading of DSB project files.

When DASYLab processes a DSB file, it reads structured data that defines project configurations, measurement settings, and workflow parameters. The vulnerable code path fails to properly validate the size or boundaries of certain data structures within the file format, allowing a malformed file to trigger writes to memory locations outside the intended allocation.

The local attack vector requires user interaction to open a malicious file, but once triggered, the attacker can achieve high-impact results including confidentiality, integrity, and availability breaches on the local system.

Root Cause

The root cause stems from insufficient bounds checking in the DSB file parsing routines. When DASYLab reads and processes file structures, it trusts length fields or array indices embedded in the file without adequate validation against allocated buffer sizes. A crafted DSB file containing manipulated size values or indices can cause the application to write beyond buffer boundaries, corrupting adjacent memory regions.

This type of vulnerability typically occurs when:

• Buffer sizes are calculated based on untrusted file input
• Array indices from file data are used without boundary validation
• Dynamic memory allocations are improperly sized based on corrupted metadata

Attack Vector

The attack requires local access and user interaction, typically executed through social engineering tactics. An attacker would craft a malicious .DSB file containing specially constructed data structures designed to trigger the out-of-bounds write condition.

The attack scenario typically involves:

1. File Crafting: The attacker creates a DSB file with malformed headers or data structures containing oversized length fields or invalid indices
2. Distribution: The malicious file is delivered to the target via email attachment, shared drives, or compromised download sources
3. Execution: When the victim opens the crafted file in DASYLab, the parser processes the corrupted structures
4. Memory Corruption: The out-of-bounds write overwrites critical memory regions, enabling potential code execution or information leakage

Since no proof-of-concept exploits are publicly available, technical details on specific exploitation techniques remain limited. For comprehensive technical details, refer to the NI Security Advisory.

Detection Methods for CVE-2026-0954

Indicators of Compromise

• Unexpected crashes or application hangs when opening DSB files in Digilent DASYLab
• Memory access violation errors or exception logs from the DASYLab process
• Unusual child processes spawned by DASYLab following file open operations
• Abnormal network connections initiated by DASYLab processes after opening project files

Detection Strategies

• Monitor for application crash dumps from DASYLab processes indicating memory corruption
• Implement file integrity monitoring to detect suspicious or externally-sourced DSB files
• Deploy endpoint detection rules targeting memory corruption exploitation techniques
• Enable Windows Defender Exploit Guard or similar mitigations to detect out-of-bounds write attempts

Monitoring Recommendations

• Configure application event logging to capture DASYLab error conditions and exceptions
• Implement user awareness training to identify suspicious DSB file sources
• Monitor file system activity for DSB files arriving from external sources (email, downloads, removable media)
• Deploy behavioral analysis tools to detect post-exploitation activities following file opens

How to Mitigate CVE-2026-0954

Immediate Actions Required

• Avoid opening DSB files from untrusted or unknown sources until patches are applied
• Verify the source and integrity of all DSB project files before opening
• Implement network segmentation to limit potential lateral movement if exploitation occurs
• Enable application whitelisting to prevent unauthorized code execution

Patch Information

NI has released a security advisory addressing this vulnerability. Organizations running affected versions of Digilent DASYLab should review the NI Security Advisory for detailed patching instructions and updated software downloads.

Contact your NI representative or check the NI support portal for the latest security updates addressing CVE-2026-0954.

Workarounds

• Implement strict file source policies permitting only DSB files from verified internal sources
• Configure email gateway filters to quarantine or block incoming .DSB file attachments
• Run DASYLab in a sandboxed environment or virtual machine when processing untrusted files
• Enable Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR) for additional exploit mitigation

# Windows configuration to verify DEP is enabled for all programs
bcdedit /set nx AlwaysOn

# Verify ASLR settings via registry (recommended to enable system-wide)
reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v MoveImages