NI LabVIEW CVE-2025-64467

Exploitation requires a user to open a specially crafted, corrupted VI file in NI LabVIEW 2025 Q3 (25.3) or any prior version; the corruption must target the resource-list structure processed by LVResFile::FindRsrcListEntry(). Limiting factors: this is a local, file-based attack (AV:L) with mandatory user interaction (UI:P) - there is no remote/network-triggerable path and no service listening to be attacked; the attacker must first socially deliver the file and rely on the victim opening it in a vulnerable LabVIEW build. No authentication is involved (PR:N) because the victim acts on their own workstation. There is no evidence the flaw fires on preview/auto-load without an explicit open.

Moderate, non-urgent priority despite a high vendor score. The CVSS 4.0 base is 8.5, but the vector is grounded in AV:L/UI:P - this is a client-side, file-parsing bug requiring a victim to open a malicious VI, not a remotely reachable service flaw. No EPSS score, no CISA KEV listing, and no public exploit code were provided, so all three exploitation-likelihood signals point to 'no known active exploitation' rather than widespread opportunistic risk. CWE-125 (out-of-bounds read) primarily yields information disclosure; the 'arbitrary code execution' claim (VC/VI/VA:H) is vendor-asserted for a read primitive, which is plausible for a heap/resource-table parser but typically requires additional exploitation work and is harder to weaponize than an out-of-bounds write. Net: a real bug worth patching in engineering/test environments, but the local+user-interaction gate and absence of exploitation signals place it well below internet-facing critical flaws. Note: no CVSS 3.1 vector was supplied - only CVSS 4.0 - so auth/interaction inferences here rely on the 4.0 vector (PR:N, UI:P).

An attacker crafts a malformed LabVIEW VI file that corrupts the resource-list structure parsed by LVResFile::FindRsrcListEntry() and delivers it to an engineer via email, a shared project repository, or a downloaded example. When the victim opens the VI in LabVIEW 2025 Q3 or earlier, the out-of-bounds read discloses adjacent memory or, in the vendor's assessment, enables arbitrary code execution in the LabVIEW process. No public proof-of-concept was identified at time of analysis.