CVE-2026-0954 is a vulnerability classified under CWE-787 (Out-of-bounds Write) affecting all versions of Digilent's DASYLab software. The flaw arises when the software loads a corrupted .DSB file, leading to a memory corruption condition due to writing outside the bounds of allocated memory. This can cause unpredictable behavior including information disclosure or arbitrary code execution. The attack vector requires an attacker to craft a malicious .DSB file and convince a user to open it, making user interaction necessary. The vulnerability does not require any privileges or authentication, increasing its risk profile. The CVSS v3.1 base score is 7.8, with metrics indicating local attack vector (AV:L), low attack complexity (AC:L), no privileges required (PR:N), user interaction required (UI:R), unchanged scope (S:U), and high impact on confidentiality, integrity, and availability (C:H/I:H/A:H). Although no public exploits are known, the potential for severe damage exists due to the ability to execute arbitrary code. DASYLab is widely used in data acquisition and control applications, often in industrial, scientific, and engineering contexts, which could make exploitation impactful in those sectors.

The vulnerability could allow attackers to execute arbitrary code on affected systems, potentially leading to full system compromise. This threatens confidentiality by exposing sensitive data, integrity by allowing unauthorized code execution or data manipulation, and availability by causing crashes or denial of service. Since DASYLab is used in data acquisition and control environments, exploitation could disrupt critical industrial or scientific processes. The requirement for user interaction limits remote exploitation but does not eliminate risk, especially in environments where users frequently exchange project files. The lack of authentication requirements means any user opening a malicious file is at risk. Organizations relying on DASYLab for operational technology or research could face significant operational and reputational damage if exploited.

1. Immediately implement strict controls on the handling and exchange of .DSB files, including user education to avoid opening files from untrusted sources. 2. Employ application whitelisting and sandboxing techniques to limit the impact of potential exploitation. 3. Monitor and restrict user permissions to minimize the ability of malicious code to escalate privileges. 4. Use endpoint detection and response (EDR) solutions to detect anomalous behaviors related to memory corruption or code execution. 5. Since no patch is currently available, consider isolating systems running DASYLab from untrusted networks and limiting file sharing. 6. Regularly back up critical data and maintain incident response plans tailored to potential exploitation scenarios. 7. Engage with Digilent for updates or patches and apply them promptly once released.