CVE-2026-0957 is a vulnerability classified under CWE-787 (Out-of-bounds Write) affecting Digilent's DASYLab software. The flaw arises from improper bounds checking when loading files, allowing a specially crafted corrupted file to trigger a memory corruption condition. This out-of-bounds write can overwrite adjacent memory, potentially leading to arbitrary code execution or information disclosure. The vulnerability impacts all versions of DASYLab, indicating a fundamental flaw in the file parsing logic. Exploitation requires an attacker to convince a user to open a malicious file, meaning user interaction is necessary but no authentication or elevated privileges are required. The CVSS v3.1 score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates that the attack vector is local (local access needed), with low complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability. Although no public exploits are known, the vulnerability poses a significant risk due to the potential for full system compromise or sensitive data leakage. DASYLab is widely used in industrial automation, data acquisition, and engineering environments, making this vulnerability particularly critical in those sectors. The lack of available patches at the time of disclosure necessitates immediate mitigation efforts.

The vulnerability could allow attackers to execute arbitrary code with the privileges of the user running DASYLab, potentially leading to full system compromise. Information disclosure could expose sensitive engineering or operational data. The impact extends to confidentiality, integrity, and availability of affected systems. Since DASYLab is often used in industrial and research environments, exploitation could disrupt critical data acquisition and control processes, causing operational downtime or safety risks. The requirement for user interaction limits remote exploitation but does not eliminate risk, especially in environments where users frequently exchange files. The absence of known exploits currently reduces immediate threat but the high severity and ease of exploitation once a malicious file is opened make this a significant concern for organizations relying on DASYLab.

1. Immediately restrict the sources of files opened in DASYLab to trusted and verified origins only. 2. Educate users on the risks of opening files from untrusted or unknown sources, emphasizing the need for caution with email attachments or downloads. 3. Implement application whitelisting or sandboxing for DASYLab to limit the impact of potential exploitation. 4. Monitor system and application logs for unusual behavior or crashes related to file loading in DASYLab. 5. If possible, isolate DASYLab usage to dedicated systems with minimal network access to reduce attack surface. 6. Engage with Digilent for updates or patches and apply them promptly once available. 7. Consider deploying endpoint detection and response (EDR) solutions that can detect exploitation attempts targeting memory corruption vulnerabilities. 8. Review and enforce strict file integrity and access controls on directories used by DASYLab to prevent unauthorized file modifications.