Critical Remote Code Execution in Digilent DASYLab (CVE‑2026‑0956) Threatens Engineering & Research Platforms
What It Is – A out‑of‑bounds read in the DSA file parser of Digilent DASYLab allows an attacker to execute arbitrary code on the host system. The flaw (CVE‑2026‑0956) scores 7.8 CVSS (High) and requires the victim to open a crafted DSA file or visit a malicious web page.
Exploitability – Public advisory released 30 Mar 2026; proof‑of‑concept code has been shared by the researcher. No known active ransomware‑as‑a‑service exploiting it yet, but the vulnerability is fully weaponizable once a user interacts with a malicious file.
Affected Products – Digilent DASYLab (all versions prior to the March 2026 security update).
TPRM Impact – Organizations that embed DASYLab in their data‑acquisition pipelines, test‑equipment, or lab‑automation workflows inherit a supply‑chain risk. A compromised third‑party tool can lead to lateral movement, data exfiltration, or sabotage of critical research and manufacturing processes.
Recommended Actions –
- Deploy Digilent’s March 2026 security update immediately.
- Verify installed DASYLab version across all endpoints and enforce version compliance.
- Block execution of DASYLab binaries from untrusted locations via application‑control policies.
- Educate end‑users on the danger of opening unknown DSA files or clicking suspicious links.
- Monitor endpoint logs for anomalous process launches or memory‑access violations associated with DASYLab.