CVE-2026-0955: NI DASYLab RCE Vulnerability

CVE-2026-0955 Overview

A memory corruption vulnerability exists in Digilent DASYLab due to an out-of-bounds read condition when loading corrupted files. This vulnerability can lead to information disclosure or arbitrary code execution on affected systems. Successful exploitation requires user interaction—specifically, an attacker must convince a user to open a specially crafted malicious file.

Critical Impact

This out-of-bounds read vulnerability affects all versions of Digilent DASYLab, potentially enabling attackers to execute arbitrary code or extract sensitive information from process memory when users open malicious files.

Affected Products

• NI DASYLab (all versions)
• Digilent DASYLab data acquisition and measurement software
• Systems running any version of DASYLab for laboratory automation

Discovery Timeline

• 2026-03-13 - CVE-2026-0955 published to NVD
• 2026-03-19 - Last updated in NVD database

Technical Details for CVE-2026-0955

Vulnerability Analysis

This vulnerability is classified as CWE-125 (Out-of-Bounds Read), a memory corruption flaw that occurs when the application reads data from a location outside the boundaries of the intended buffer. In the context of DASYLab, the vulnerability manifests during the file parsing process when loading corrupted or maliciously crafted project files.

When DASYLab processes a specially constructed file, insufficient boundary checking allows the application to read memory beyond allocated buffer limits. This can expose sensitive data residing in adjacent memory regions, including potentially confidential information, memory addresses useful for bypassing ASLR, or other data that could facilitate further exploitation.

The local attack vector requires user interaction, meaning exploitation depends on social engineering tactics to convince victims to open malicious files. Despite this limitation, the potential for arbitrary code execution makes this vulnerability particularly dangerous in targeted attack scenarios.

Root Cause

The root cause of CVE-2026-0955 lies in inadequate bounds validation during file parsing operations within DASYLab. When the application loads project files, it fails to properly validate that read operations stay within the allocated buffer boundaries. Corrupted or maliciously structured file data can cause the parser to read beyond the intended memory region, triggering the out-of-bounds read condition.

This type of vulnerability commonly occurs when parsing variable-length fields, embedded offsets, or array indices from file data without sufficient validation against buffer constraints.

Attack Vector

The attack requires local access and user interaction to execute. An attacker would typically deliver the malicious DASYLab file through phishing emails, compromised file shares, or social engineering campaigns targeting organizations using DASYLab for data acquisition and measurement tasks.

The attack chain typically follows this pattern:

1. Attacker creates a corrupted DASYLab project file with malformed data structures
2. The malicious file is delivered to the target through email attachment, file sharing, or other distribution methods
3. The victim opens the file in DASYLab
4. The out-of-bounds read is triggered during file parsing
5. Attacker achieves information disclosure or arbitrary code execution

Due to the nature of the vulnerability, no remote exploitation path exists; however, the potential impact of arbitrary code execution elevates the risk profile significantly.

Detection Methods for CVE-2026-0955

Indicators of Compromise

• Unexpected crashes or instability in the DASYLab application during file operations
• Memory access violations or application errors reported in Windows Event Logs when loading project files
• Suspicious DASYLab project files received from external or untrusted sources
• Abnormal network activity or process spawning following DASYLab file operations

Detection Strategies

• Monitor for DASYLab application crashes or exceptions that may indicate exploitation attempts
• Implement endpoint detection rules to identify anomalous behavior following DASYLab file operations
• Configure application whitelisting to restrict execution of unauthorized processes spawned from DASYLab
• Deploy file integrity monitoring on systems where DASYLab processes sensitive data

Monitoring Recommendations

• Enable crash dump collection for DASYLab to capture forensic evidence of exploitation attempts
• Implement user awareness training regarding suspicious file attachments targeting laboratory software
• Monitor email gateways for DASYLab file extensions arriving from external sources
• Review application logs for repeated file loading failures that could indicate fuzzing or exploitation attempts

How to Mitigate CVE-2026-0955

Immediate Actions Required

• Review the NI Security Advisory for official guidance and patches
• Restrict DASYLab file handling to trusted sources only until patches are applied
• Implement application sandboxing where possible to limit the impact of potential exploitation
• Educate users about the risks of opening DASYLab files from untrusted sources

Patch Information

NI has released a security advisory addressing this vulnerability. Organizations using Digilent DASYLab should consult the official NI Security Advisory for patch availability and installation instructions.

Since this vulnerability affects all versions of DASYLab, organizations should prioritize obtaining and deploying the security update as soon as it becomes available from the vendor.

Workarounds

• Avoid opening DASYLab project files from untrusted or unknown sources
• Implement strict email filtering to quarantine DASYLab file attachments from external senders
• Run DASYLab in a virtualized environment or sandbox to contain potential compromise
• Consider disabling or restricting DASYLab access on systems where it is not essential until patches are deployed

# Configuration example
# Restrict file associations as a temporary measure
# Windows: Remove or modify file type associations for DASYLab files
# This prevents accidental opening of malicious files via double-click

# Check current file associations
assoc .dsy

# Consider removing association (requires administrator privileges)
# assoc .dsy=

# Alternative: Configure Group Policy to restrict DASYLab file handling
# from untrusted network locations using Software Restriction Policies