NI LabVIEW CVE-2025-64462
HIGHAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious VI file
-
DeliveryDeliver via email/download/shared project
-
ExploitVictim opens VI in LabVIEW
-
ExecutionTrigger OOB read in RGetMemFileHandle()
-
ImpactLeak memory or execute code in user context
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an attacker to socially engineer a LabVIEW user into opening a specially crafted/corrupted .VI (Virtual Instrument) file; the flaw is triggered during VI-file parsing in LVResFile::RGetMemFileHandle(). Limiting factors: the attack vector is local (the malicious file must reach and be opened on the victim's machine), mandatory passive user interaction is required (UI:P - the user must open the file), and it affects NI LabVIEW 2025 Q3 (25.3) and prior. No elevated privileges or authentication are needed (PR:N), and no special product configuration is required beyond a standard LabVIEW installation capable of opening VI files. |
| Impact | The vendor CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H, base 8.5) is internally consistent with the description: this is a client-side, file-parsing bug reached only when a victim opens a maliciously crafted VI file, so the attack vector is genuinely Local (AV:L) despite the potential for remote delivery of the file. Impact is high across confidentiality, integrity, and availability because the out-of-bounds read (CWE-125) can leak memory or be leveraged toward arbitrary code execution in the LabVIEW process context. There is no CISA KEV listing, no EPSS score provided, and no public proof-of-concept referenced - only the NI vendor advisory - so exploitation status is 'no public exploit identified at time of analysis.' This is a real, patch-worthy memory-corruption issue, but the required user interaction plus local attack vector make it a targeted/social-engineering risk rather than a wormable remote threat, so it should be prioritized below network-facing unauthenticated RCE. Note the 'RCE' outcome is described by NI as a possibility ('may result in ... arbitrary code execution'), not a demonstrated capability - treat code execution as plausible but unconfirmed. |
| Exploit ScenarioDerived | An attacker crafts a corrupted .VI file that triggers the out-of-bounds read in LVResFile::RGetMemFileHandle() and delivers it via email, a shared project, or a download, convincing an engineer to open it in LabVIEW. When the file is parsed, the flaw leaks process memory (information disclosure) or is chained toward arbitrary code execution in the user's context. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
NI LabVIEW 2025 Q3 (25.3) and prior versions can be exploited to cause an out-of-bounds read in LVResFile::RGetMemFileHandle() by opening a specially crafted VI file, potentially leading to information disclosure or arbitrary code execution. Exploitation requires user interaction to open the malicious file, and no public exploit identified at time of analysis. The vulnerability affects a wide range of LabVIEW versions, and the vendor has issued an advisory with updates.
RemediationAI
Patch available per vendor advisory: NI has released updates; consult the advisory for the specific fixed version. Until patched, mitigate by never opening VI files from untrusted sources. Consider blocking .vi file attachments at email and web gateways to prevent delivery of malicious files; however, this may disrupt legitimate workflows that rely on sharing VI files, so an allowlist of trusted senders may be preferable. Additionally, enforce the principle of least privilege for users who open VI files to limit the impact of any exploitation.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
NI LabVIEW is a graphical development environment for test, measurement, and control applications. VI files are the program files used by LabVIEW. The vulnerability is an out-of-bounds read (CWE-125) in the LVResFile::RGetMemFileHandle() function, which is part of the code that parses VI files. When a corrupted VI file is opened, the function may read memory beyond the intended buffer, potentially disclosing sensitive data from the process memory or, if the read data influences subsequent execution, enabling code execution. The CPE entries list specific affected versions: 2022 Q1, 2022 Q3, 2022 Q3 Patch 1, Patch 2, Patch 4, Patch 5, Patch 6, 2023 Q1, 2023 Q3, and 2023 Q3 Patch 1; however, the vendor states that 2025 Q3 (25.3) and all prior versions are affected. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P) indicates that the attack is local, requires no privileges, and requires the user to open the malicious file, which aligns with the client-side nature of this parsing vulnerability.
Know when Labview gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Local vector since a crafted file must be opened (AV:L, UI:R), no privileges needed (PR:N), and high CIA impact from memory disclosure plus possible code execution in the user's process.
Primary rating from Vendor (ni).
CVSS VectorVendor: ni
DescriptionCVE.org
There is an out of bounds read vulnerability in NI LabVIEW in LVResFile::RGetMemFileHandle() when parsing a corrupted VI file. This vulnerability may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted VI. This vulnerability affects NI LabVIEW 2025 Q3 (25.3) and prior versions.
Executive ViewAI
NI LabVIEW 2025 Q3 (25.3) and earlier versions contain a high-severity memory safety vulnerability that could be triggered when a user opens a specially crafted VI file, potentially leading to sensitive information disclosure or arbitrary code execution on affected engineering workstations. This affects organizations using LabVIEW for test, measurement, and control, particularly in engineering and operational technology environments where those systems may hold intellectual property or connect to critical processes. Leadership should prioritize because exploitation requires only user interaction, and while no public exploit is identified at time of analysis, the potential for data loss or unauthorized code execution warrants immediate risk reduction.
Restrict opening of untrusted VI files, enforce email and web gateway filtering for .vi attachments, user awareness training, application allowlisting, least privilege, sandboxing, and network segmentation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)CVE.org
An exploitable memory corruption vulnerability exists in the LvVariantUnflatten functionality in 64-bit versions of LabV
An exploitable memory corruption vulnerability exists in the RSRC segment parsing functionality of LabVIEW 2017, LabVIEW
Absolute path traversal vulnerability in the 3D Graph ActiveX control in cw3dgrph.ocx in National Instruments LabWindows
Multiple absolute path traversal vulnerabilities in National Instruments cwui.ocx, as used in National Instruments LabWi
Memory corruption in NI LabVIEW 2026 Q3 (26.3.0) and all prior versions enables information disclosure or arbitrary code
Memory corruption in NI LabVIEW 2026 Q3 (26.3.0) and all prior versions enables information disclosure or arbitrary code
Memory corruption in NI LabVIEW 2026 Q3 (26.3.0) and all prior versions enables information disclosure or arbitrary code
Memory corruption in NI LabVIEW (all versions through 26.3.0) enables information disclosure or arbitrary code execution
Memory corruption in NI LabVIEW 26.3.0 and all prior versions enables information disclosure or arbitrary code execution
Memory corruption in NI LabVIEW 2026 Q3 (26.3.0) and all prior versions enables information disclosure or arbitrary code
Out of bounds write vulnerability due to improper bounds checking in NI LabVIEW reading CPU info from cache that may res
Out of bounds write vulnerability due to improper bounds checking in NI LabVIEW in InitCPUInformation() that may result
GitHub PoC
Exploit-DB