There are two out-of-bounds write vulnerabilities when parsing user files in Digilent DASYLab that may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted DASYLab file. These vulnerabilities affect all versions of Digilent DASYLab.
These vulnerabilities are identified as CVE-2026-0954 and CVE-2026-0957.
There are no fixes available for these issues. Digilent strongly recommends users practice good cyber awareness and avoid opening files from any untrusted source. These issues are not exploitable remotely.
At NI, we view the security of our products as an important part of our commitment to our customers. Go to ni.com/security to stay informed and act upon security alerts and issues.
Digilent would like to thank Anonymous working with Trend Micro Zero Day Initiative for reporting CVE-2026-0954 and working with us on coordinated disclosure.
Digilent would like to thank Rocco Calvi (@TecR0c) with TecSecurity working with Trend Micro Zero Day Initiative for reporting CVE-2026-0957 and working with us on coordinated disclosure.
| Product Version | Mitigation |
|---|---|
| DASYLab – all versions | See above |