Description

There is an out-of-bounds write vulnerability in DASYLab due to improper validation of user-supplied data, resulting in a write past the end of an allocated heap. Successful exploitation requires an attacker to get a user to open a specially crafted .DSB file.  This issue affects all versions before 2026.0.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-09-03T22:18:09.950Z",
  "pubdate": "2026-09-03T22:18:09.950Z",
  "executiveSummary": "DASYLab versions prior to 2026.0.0 contain a critical out-of-bounds (OOB) write vulnerability resulting from insufficient validation of user-supplied data within .DSB files.\nThe vulnerability resides in the application's file parsing logic, where improper bounds checking allows an attacker to perform a write operation beyond the intended heap-allocated memory boundaries.\nExploitation requires the victim to open a specially crafted .DSB file, facilitating an attack vector dependent on social engineering.\nSuccessful exploitation may lead to memory corruption, potentially enabling arbitrary code execution under the security context of the logged-in user.\nThis vulnerability poses a significant risk to systems using DASYLab, as it bypasses standard memory safety mechanisms during the processing of untrusted project files.\nThere are no authentication or specific privilege requirements for the attacker, provided they can successfully deliver the malicious file to the target user.",
  "technicalDetails": "The vulnerability is characterized as an out-of-bounds (OOB) heap write, occurring during the parsing process of .DSB files within the DASYLab application. The root cause is a failure to adequately validate the length or structure of data fields provided within the file format against the size of the destination buffer allocated on the heap.\nWhen DASYLab processes a .DSB file, it reads data into pre-allocated memory structures. If the file contains malformed or excessively large input fields that exceed the expected boundaries, the parsing logic fails to enforce strict limits. Consequently, the application writes data past the end of the intended heap buffer, corrupting adjacent heap metadata or adjacent objects.\nThe attack flow initiates when an attacker distributes a crafted .DSB file to a target user. Upon opening the file, the vulnerable parsing routine is triggered. The attacker leverages the OOB write to overwrite sensitive memory structures, such as function pointers or object vtables, which may redirected execution flow when accessed by the application. This typically involves heap grooming or spraying techniques to ensure that predictable structures occupy the memory addresses affected by the corruption.\nSince the vulnerability is triggered via file processing, it does not require network exposure or remote authentication. The attack is effective locally once the user interacts with the malicious file. The privilege level of the subsequent code execution is inherited from the user account currently executing the DASYLab instance.\nThe post-exploitation impact includes the potential for arbitrary code execution, which can lead to full system compromise, data exfiltration, or the installation of persistent threats. By manipulating the heap state through the OOB write, an attacker can bypass modern exploit mitigations if they successfully gain control over the instruction pointer through memory layout manipulation. This issue affects all iterations of the software prior to version 2026.0.0, rendering these legacy and current versions susceptible to memory corruption-based attacks until addressed."
}