CVE-2026-0955 is a vulnerability classified under CWE-125 (Out-of-bounds Read) affecting all versions of Digilent's DASYLab software. The flaw arises when the software attempts to load a corrupted file, leading to an out-of-bounds memory read. This memory corruption can cause the application to leak sensitive information or allow an attacker to execute arbitrary code within the context of the affected application. The attack vector requires local access and user interaction, specifically the victim opening a maliciously crafted file. The CVSS 3.1 base score of 7.8 reflects a high severity, with attack vector being local (AV:L), low attack complexity (AC:L), no privileges required (PR:N), but user interaction required (UI:R). The scope is unchanged (S:U), and the impact on confidentiality, integrity, and availability is high (C:H/I:H/A:H). Although no patches or exploits are currently known, the vulnerability poses a serious risk to environments where DASYLab is used, especially in industrial, scientific, or engineering contexts where this software is common. The lack of a patch at the time of publication necessitates immediate mitigation efforts to reduce exposure.

The vulnerability can lead to severe consequences including unauthorized disclosure of sensitive data, corruption or manipulation of data, and full compromise of the affected system through arbitrary code execution. Organizations relying on DASYLab for data acquisition and analysis in critical industrial, research, or engineering environments could face operational disruption, intellectual property theft, or safety risks if exploited. The requirement for user interaction limits remote exploitation but does not eliminate risk, especially in environments where users may open files from untrusted sources. The high impact on confidentiality, integrity, and availability underscores the potential for significant damage to organizational assets and reputation.

Until an official patch is released, organizations should implement strict controls on file sources by restricting or blocking the opening of DASYLab files from untrusted or unknown origins. User training should emphasize the risks of opening unsolicited or suspicious files. Employ application whitelisting and sandboxing techniques to limit the execution context of DASYLab. Network segmentation can reduce exposure by isolating systems running DASYLab from less trusted networks. Monitoring for unusual application behavior or crashes may help detect exploitation attempts. Additionally, organizations should maintain up-to-date backups and prepare incident response plans specific to this vulnerability. Once a patch becomes available, prompt testing and deployment are critical to fully remediate the risk.