CVE-2026-0956

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

There is a memory corruption vulnerability due to an out-of-bounds read when loading a corrupted file in Digilent DASYLab. This vulnerability may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted file. This vulnerability affects all versions of Digilent DASYLab.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-125

Affected software

No affected versions have been published.

Timeline

Published: Mar 13, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-09577.8There is a memory corruption vulnerability due to an out-of-bounds write when loading a corrupted file in Digilent DASYLab. This vulnerabil CVE-2026-09587.5GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 th CVE-2026-09596.5IEEE 802.11 protocol dissector crash in Wireshark 4.6.0 to 4.6.2 and 4.4.0 to 4.4.12 allows denial of service CVE-2026-09605.5HTTP3 protocol dissector infinite loop in Wireshark 4.6.0 to 4.6.2 allows denial of service CVE-2026-09616.5BLF file parser crash in Wireshark 4.6.0 to 4.6.2 and 4.4.0 to 4.4.12 allows denial of service CVE-2026-09626.5SOME/IP-SD protocol dissector crash in Wireshark 4.6.0 to 4.6.2 and 4.4.0 to 4.4.12 allows denial of service CVE-2026-09638.8An input neutralization vulnerability in the File Operations API Endpoint component of Crafty Controller allows a remote, authenticated atta CVE-2026-09646.3A malicious SCP server can send unexpected paths that could make the client application override local files outside of working directory. T CVE-2026-09653.3A flaw was found in libssh where it can attempt to open arbitrary files during configuration parsing. A local attacker can exploit this by p CVE-2026-09668.2A flaw was found in libssh. The API function `ssh_get_hexa()` is vulnerable to a denial of service when processing zero-length input. This c CVE-2026-09675.5A flaw was found in libssh. A remote attacker, by controlling client configuration files or known_hosts files, could craft specific hostname CVE-2026-09683.1A flaw was found in libssh in which a malicious SFTP (SSH File Transfer Protocol) server can exploit this by sending a malformed 'longname'