Deserialization of Untrusted Data Vulnerability in DASYLab
Created Aug 17, 2026
Overview
There is a deserialization of untrusted data vulnerability when parsing user-supplied files in DASYLab that may result in arbitrary code execution. Successful exploitation requires a user to open a specially crafted DSB file, and this vulnerability affects all versions of DASYLab before 2026.0.0 (Build 65).
This advisory covers CVE-2025-9189.
Contents
- Mitigation Guidance
- Affected Products
- CVSS Score
- Further Information
- Acknowledgements
- Additional Resources
Mitigation Guidance
This issue is resolved in DASYLab 2026.0.0 (Build 65). measX recommends that users update to DASYLab 2026.0.0 (Build 65) or later and avoid opening DASYLab or DSB files from untrusted sources. Exploitation requires local user interaction in that the user must open a malicious DSB file, and the issue is not exploitable remotely.
Affected Products
| Product Version | Mitigation |
|---|---|
| DASYLab – all versions before 2026.0.0 (Build 65) | Update to DASYLab 2026.0.0 (Build 65) or later; avoid opening untrusted DASYLab or DSB files |
| DASYLab 2026.0.0 (Build 65) | Not affected |
CVSS Score
- CVE-2025-9189 – 7.8 (CVSS 3.1), vector: AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H; 8.5 (CVSS 4.0), vector: AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N.
This issue is classified as CWE-502 (Deserialization of Untrusted Data).
Further Information
The vulnerability was reported against DASYLab 2024 (17.0.0), Build 20, and confirmed on Windows 10 22H2 x64.
CVE-2025-9189 is a deserialization of untrusted data vulnerability in DASYLab. A Script module embedded in a DSB worksheet stores serialized Python objects (pickle) that are automatically deserialized when the file is opened, allowing an attacker to execute arbitrary code in the context of the current process if a user opens a malicious DSB file.
Acknowledgements
measX credits kimiya, working with Trend Micro Zero Day Initiative, for reporting this issue and coordinating disclosure.