CVE-2026-0955 is a memory corruption vulnerability classified under CWE-125 (Out-of-bounds Read) found in Digilent's DASYLab software. The flaw arises when the software attempts to load a corrupted file, leading to an out-of-bounds read operation in memory. This improper memory access can cause the application to disclose sensitive information or enable arbitrary code execution, potentially allowing an attacker to take control of the affected system. Exploitation requires an attacker to convince a user to open a specially crafted file, making user interaction necessary. The vulnerability affects all versions of DASYLab, indicating a fundamental flaw in the file parsing logic. The CVSS 3.1 base score of 7.8 reflects high severity, with attack vector local (AV:L), low attack complexity (AC:L), no privileges required (PR:N), user interaction required (UI:R), unchanged scope (S:U), and high impact on confidentiality, integrity, and availability (C:H/I:H/A:H). No patches or fixes have been released yet, and no known exploits have been observed in the wild, but the potential impact is significant due to the possibility of remote code execution and data leakage.

The vulnerability poses a serious risk to organizations using Digilent DASYLab, particularly in sectors relying on data acquisition and control systems such as industrial automation, scientific research, and engineering. Successful exploitation could lead to unauthorized disclosure of sensitive information, disruption of critical processes, or full system compromise through arbitrary code execution. This can result in operational downtime, loss of intellectual property, safety hazards in industrial environments, and reputational damage. Since exploitation requires user interaction, social engineering or phishing campaigns could be used to deliver malicious files. The broad impact on confidentiality, integrity, and availability makes this a critical concern for organizations that integrate DASYLab into their workflows.

Until an official patch is released, organizations should implement strict controls on file handling within DASYLab environments. This includes restricting the opening of files from untrusted or unknown sources, employing robust user training to recognize and avoid suspicious files, and using application whitelisting to limit execution of unauthorized code. Network segmentation can reduce exposure by isolating systems running DASYLab from general user networks. Monitoring and logging file access and application behavior may help detect attempted exploitation. Additionally, organizations should maintain up-to-date backups and prepare incident response plans tailored to potential exploitation scenarios. Once a patch becomes available, prompt application is critical. Vendors and users should also consider sandboxing DASYLab instances to contain potential exploits.