CVE-2025-9189

HighCVSS 7.8/10Last modified Sep 3, 2026

Description

There is an out of bounds write vulnerability due to improper bounds checking resulting in a large destination address when parsing a DSB file with Digilent DASYLab. This vulnerability may result in arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted DSB file. The vulnerability affects all versions of DASYLab.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-1285CWE-787

Affected software

No affected versions have been published.

Timeline

Published
Sep 2, 2025
Last modified
Sep 3, 2026
NVD status
Modified

Related CVEs from 2025

CVE-2025-91904.8The configuration of Cursor on macOS, specifically the "RunAsNode" fuse enabled, allows a local attacker with unprivileged access to executeCVE-2025-91916.3The Houzez theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.1.6 via deserialization of untrCVE-2025-91933.5A flaw has been found in TOTVS Portal Meu RH up to 12.1.17. Impacted is an unknown function of the component Password Reset Handler. ExecutiCVE-2025-91944.3The Constructor theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the clean() funcCVE-2025-91954.4Improper input validation in firmware of some Solidigm DC Products may allow an attacker with local access to cause a Denial of ServiceCVE-2025-91965.3The Trinity Audio – Text to Speech AI audio player to convert content into audio plugin for WordPress is vulnerable to Sensitive InformationCVE-2025-91986.5The Wp cycle text announcement plugin for WordPress is vulnerable to SQL Injection via the 'cycle-text' shortcode in all versions up to, andCVE-2025-91996.5The Woo superb slideshow transition gallery with random effect plugin for WordPress is vulnerable to SQL Injection via the 'woo-superb-slideCVE-2025-92007.5The Blappsta Mobile App Plugin – Your native, mobile iPhone App and Android App plugin for WordPress is vulnerable to SQL Injection via the CVE-2025-92017.8A potential DLL hijacking vulnerability was discovered in Lenovo Browser during an internal security assessment that could allow a local useCVE-2025-92024.3The ColorMag theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the welcome_notice_CVE-2025-92036.4The Media Player Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'subtitle_ssize', 'track_tit
CVE-2025-9189: High severity, CVSS 7.8 | Vulnix