Critical Remote Code Execution in Digilent DASYLab (CVE-2026-0955) Threatens Lab Automation Platforms
What It Is – A newly disclosed out‑of‑bounds read in the DSA file parser of Digilent DASYLab (CVE‑2026‑0955) enables remote attackers to execute arbitrary code. The flaw is triggered when a victim opens a malicious DSA file or visits a crafted web page that forces the file to be processed.
Exploitability – Public advisory released 30 Mar 2026; proof‑of‑concept code has been shared by the researcher. CVSS 7.8 (High) – AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. No known active ransomware or mass‑exploitation campaigns yet, but the required user interaction makes it a realistic threat vector.
Affected Products – Digilent DASYLab (all versions prior to the 2026‑03‑30 security update).
TPRM Impact – Organizations that embed DASYLab in manufacturing execution systems, research labs, or IoT data‑acquisition pipelines inherit a supply‑chain risk: a compromised third‑party tool can lead to system takeover, data loss, or sabotage of production processes.
Recommended Actions –
- Deploy Digilent’s 2026‑03‑30 security update immediately.
- Verify installed DASYLab version across all assets; enforce patch compliance.
- Block execution of DASYLab binaries from untrusted directories and enforce application whitelisting.
- Scan inbound files (email, web downloads) for DSA payloads using updated AV/EDR signatures.
- Conduct a focused risk assessment of any downstream processes that rely on DASYLab‑generated data.