NI LabVIEW CVE-2025-64469

Exploitation requires an attacker to deliver a specially crafted/corrupted VI file and have a victim open it in NI LabVIEW (versions 2025 Q3 / 25.3 and prior) - the trigger is parsing the malformed resource list entry in LVResFile::FindRsrcListEntry(). Limiting factors: the attack vector is local (AV:L, the malicious file must reach and be opened on the target machine) and mandatory user interaction (UI:P) is required - there is no remote, unauthenticated, zero-click path. No special LabVIEW configuration is needed beyond the ability to open a VI file, and no authentication is required (PR:N), so any user who opens the file is exposed. Risk concentrates in environments where LabVIEW VI files are routinely shared between users.

This is a genuine but non-urgent priority. The CVSS 4.0 base score of 8.5 is driven by full high impact to confidentiality, integrity, and availability (VC:H/VI:H/VA:H), but the vector is fundamentally client-side: AV:L (local) and UI:P mean exploitation is not remote-network-triggerable - it requires an attacker to deliver a malicious VI file and convince a user to open it in LabVIEW. There is no EPSS score, no CISA KEV listing, and no public exploit code identified in the provided data, so all three exploitation-likelihood signals point to no observed or automated exploitation. PR:N (no privileges) lowers the barrier somewhat, but the mandatory user-interaction step (UI:P) and file-delivery requirement keep real-world risk in the moderate band rather than critical. The single vendor advisory (ni.com) confirms the flaw and impact but provides no exploitation telemetry. Overall: a high-impact memory-corruption bug that is credible for arbitrary code execution, yet gated behind social-engineering/file-open and lacking any evidence of active or automated exploitation - treat as a patch-in-normal-cycle item, prioritized higher for engineering/test environments where LabVIEW VI files are routinely exchanged.

An attacker crafts a corrupted LabVIEW VI file with a malformed resource list entry that overflows a stack buffer in LVResFile::FindRsrcListEntry() and emails or shares it with an engineer, who opens it in LabVIEW. Parsing the file triggers the stack-based overflow, leading to information disclosure or arbitrary code execution in the context of the user running LabVIEW. No public exploit code is identified at time of analysis; exploitation depends on the victim opening the attacker-supplied VI.