CVE-2026-64199 is a high severity (CVSS 7.8) out-of-bounds read in DASYLab, the data acquisition software, triggered by opening a specially crafted .DSB file. All versions before 2026.0.0 (Build 65) are affected, and exploitation needs a user to open the file. The vendor, measX, fixed it in that release, so update and avoid untrusted files.
What's affected
The record says all DASYLab versions before 2026.0.0. The measX advisory is more precise: before 2026.0.0 (Build 65), with that build not affected. The weakness is CWE-125 (out-of-bounds read).
For this CVE the vendor describes a read outside the bounds of an allocated data structure. The advisory covers three CVEs together; the other two are CVE-2026-64198 and CVE-2026-64200. All three are triggered by DSB file parsing, require a user to open a malicious file, and are described as not exploitable remotely.
The record's CVSS 3.1 score of 7.8 matches the vendor. The vendor also gives a CVSS 4.0 score of 8.5. The record lists the product under NI, while the advisory is published by measX. Both name DASYLab.
How to check if you're exposed
Find the installed DASYLab version and build.
Get-Package -Name "*DASYLab*" | Select-Object Name, Version
The about dialog in DASYLab shows the same information. Any version before 2026.0.0 (Build 65) is affected. Then find where DSB files come from in your organisation: shared drives, email, vendor deliveries, download sites. Those are the paths a malicious file would take.
Whatever the product, a current inventory of what you run is what turns a CVE notice into a quick answer. The Gold page for this CVE tracks how its record changes over time, and the free in-browser dependency scan at gold.safeguard.sh/scan covers the application libraries you ship.
What to do now
- Update every DASYLab installation to 2026.0.0 (Build 65) or later.
- Do not open DASYLab or DSB files from untrusted sources, as measX advises.
- Treat DSB files you receive from outside the company as untrusted until checked, and open them on a test machine first if you must.
- Limit the rights of the accounts that run DASYLab. Code that runs through a file bug runs with the user's rights.
- Keep copies of worksheets in version control or a protected share, so you can tell a changed file from the original.
Why it matters
File parsers are a common source of memory safety bugs, because they turn bytes from an untrusted source into internal structures. When the parser does not check a length or index, it can touch memory outside the buffer it allocated. This CVE is a read outside the bounds of an allocated data structure. The class is CWE-125.
The measX advisory says exploitation needs a local user to open a crafted file. That limits the attack path but does not remove it: data acquisition worksheets are often shared by email or network drives. The vendor says information disclosure or code execution may result. The record does not mark the CVE as exploited in the wild, and it is not in CISA KEV.
Quick check
Can this be exploited over the network without any user action?
No. The vendor says exploitation requires a user to open a crafted DSB file and that the issues are not exploitable remotely.
Sources
Last reviewed: 18 October 2026.
