Critical Out‑Of‑Bounds Write RCE in Digilent DASYLab (CVE‑2026‑0954) Threatens Lab‑Automation Environments

Critical Out‑Of‑Bounds Write RCE in Digilent DASYLab (CVE‑2026‑0954) Threatens Lab‑Automation Environments

What It Is — A newly disclosed out‑of‑bounds write flaw in the DSB file parser of Digilent DASYLab enables remote code execution. The vulnerability (CVE‑2026‑0954) scores 7.8 (CVSS 3.1) and requires a victim to open a malicious DSB file or visit a crafted web page that triggers the parser.

Exploitability — No public exploit code has been released, but a proof‑of‑concept exists and the vulnerability is actively exploitable once a user interacts with a malicious file. The low‑privilege, remote‑code‑execution vector makes it a high‑risk issue for any organization that runs DASYLab in production or test labs.

Affected Products — Digilent DASYLab (all versions prior to the March 2026 security update).

TPRM Impact —

• Third‑party lab‑automation tools are often embedded in R&D pipelines, manufacturing test rigs, and academic research; a compromise can cascade to downstream data and intellectual property.
• The need for user interaction means phishing or malicious file distribution campaigns can target employees, expanding the attack surface beyond the software itself.

Recommended Actions —

1. Deploy Digilent’s March 2026 security update immediately on all DASYLab installations.
2. Enforce strict file‑type controls and sandbox execution for any DSB files received from external sources.
3. Conduct a targeted phishing awareness campaign for staff who handle lab data.
4. Review and segment network zones that host DASYLab to limit lateral movement.
5. Add DASYLab to your vulnerability‑management inventory and monitor for any anomalous process activity.

Source: Zero Day Initiative Advisory ZDI‑26‑236