Critical Out‑of‑Bounds Write RCE in Digilent DASYLab (CVE‑2026‑0957) Threatens Lab‑Automation Environments
What It Is – A newly disclosed out‑of‑bounds write flaw in the DSA file parser of Digilent DASYLab permits remote code execution. The vulnerability (CVE‑2026‑0957) scores 7.8 (CVSS 3.1) and requires a victim to open a malicious DSA file or view a crafted web page.
Exploitability – Public advisory released 30 Mar 2026; proof‑of‑concept exists (researcher Rocco Calvi). Exploit requires user interaction but can be weaponised in phishing or supply‑chain attacks.
Affected Products – Digilent DASYLab (all versions prior to the March 2026 security update).
TPRM Impact – Organizations that embed DASYLab in engineering, R&D, or manufacturing workflows inherit a direct code‑execution risk from a third‑party component. A compromised lab workstation could be leveraged to pivot into corporate networks, exfiltrate intellectual property, or disrupt production pipelines.
Recommended Actions –
- Deploy Digilent’s March 2026 security update immediately.
- Block execution of DASYLab on systems that do not require it.
- Enforce strict file‑type controls and sandboxing for any DSA files received via email or web downloads.
- Update incident‑response playbooks to include DASYLab‑specific indicators of compromise.
- Conduct a rapid inventory of all third‑party software used in lab environments and assess exposure.