CVE-2026-0957: NI DASYLab RCE Vulnerability

CVE-2026-0957 Overview

A memory corruption vulnerability exists in Digilent DASYLab due to an out-of-bounds write when loading a corrupted file. This vulnerability may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted file. This vulnerability affects all versions of Digilent DASYLab.

Critical Impact

Successful exploitation of this out-of-bounds write vulnerability could allow attackers to execute arbitrary code or disclose sensitive information through maliciously crafted files.

Affected Products

• NI DASYLab (all versions)
• Digilent DASYLab data acquisition software
• Systems using DASYLab for measurement and control applications

Discovery Timeline

• 2026-03-13 - CVE-2026-0957 published to NVD
• 2026-03-19 - Last updated in NVD database

Technical Details for CVE-2026-0957

Vulnerability Analysis

This vulnerability is classified as CWE-787 (Out-of-bounds Write), a critical memory corruption flaw that occurs when software writes data past the end or before the beginning of an allocated memory buffer. In the context of DASYLab, this issue manifests during the file parsing process when the application attempts to load a corrupted or maliciously crafted file.

The attack requires local access and user interaction, meaning an attacker must convince a victim to open a specially crafted file. Once opened, the malformed file triggers the out-of-bounds write condition, potentially corrupting adjacent memory structures. This corruption can be leveraged to overwrite critical data structures, function pointers, or return addresses, ultimately enabling arbitrary code execution within the context of the running application.

Root Cause

The root cause of this vulnerability lies in insufficient boundary checking during file parsing operations in DASYLab. When processing file contents, the application fails to properly validate the size and boundaries of data being written to memory buffers. This allows maliciously crafted file structures to specify data lengths or offsets that exceed allocated buffer sizes, resulting in memory corruption.

The absence of proper input validation for file structure elements enables attackers to craft files that exploit this parsing weakness, writing attacker-controlled data to unintended memory locations.

Attack Vector

The attack vector requires local access and user interaction. An attacker would need to craft a malicious DASYLab project file or data file and deliver it to a target user through social engineering techniques such as:

• Email attachments disguised as legitimate DASYLab project files
• Downloads from compromised or malicious websites
• Shared network drives or removable media
• Phishing campaigns targeting organizations using DASYLab for data acquisition

When the victim opens the malicious file in DASYLab, the out-of-bounds write is triggered during the file parsing phase. The attacker-controlled data written beyond buffer boundaries can corrupt program state and potentially redirect execution flow to attacker-supplied shellcode or ROP gadgets, achieving arbitrary code execution with the privileges of the current user.

Detection Methods for CVE-2026-0957

Indicators of Compromise

• Unexpected DASYLab application crashes or instability when opening project files
• Unusual memory access patterns or access violation errors in DASYLab processes
• Suspicious file activity involving .DSB, .DSL, or other DASYLab-associated file extensions
• Unexpected child processes spawned by DASYLab application

Detection Strategies

• Monitor for anomalous DASYLab process behavior including unexpected memory allocations or access violations
• Implement file integrity monitoring for DASYLab project files and directories
• Deploy endpoint detection rules to identify exploitation attempts targeting memory corruption vulnerabilities
• Use application whitelisting to prevent unauthorized code execution from DASYLab context

Monitoring Recommendations

• Enable crash dump collection for DASYLab processes to facilitate post-incident analysis
• Monitor process creation events for child processes spawned by DASYLab executables
• Implement logging for file access events involving DASYLab project files from untrusted sources
• Deploy behavioral analysis to detect code execution patterns inconsistent with normal DASYLab operations

How to Mitigate CVE-2026-0957

Immediate Actions Required

• Review the NI Security Update Advisory for vendor guidance and available patches
• Restrict DASYLab file handling to trusted sources only until patching is complete
• Implement network segmentation to isolate systems running vulnerable DASYLab versions
• Train users to avoid opening DASYLab files from untrusted or unexpected sources

Patch Information

NI has published a security advisory addressing this vulnerability. Administrators should consult the NI Security Update Advisory for detailed patch information and update instructions. As this vulnerability affects all versions of Digilent DASYLab, ensure all deployed instances are updated according to vendor recommendations.

Workarounds

• Implement strict file handling policies preventing users from opening DASYLab files from external or untrusted sources
• Use sandboxing or virtualization when opening files from potentially untrusted sources
• Deploy application control solutions to limit DASYLab execution to known-safe environments
• Consider temporarily disabling DASYLab on non-critical systems until patches are applied