Which versions of NI LabVIEW are affected by CVE-2026-16233?

NI LabVIEW 2026 Q3 (version 26.3.0) and all prior versions contain a critical memory corruption vulnerability enabling information disclosure or arbitrary code execution through malicious Virtual…. A patch is available.

How to fix or mitigate CVE-2026-16233?

Within 24 hours: Identify all LabVIEW 2026 Q3 and earlier deployments across the organization; issue urgent security alert to users instructing them to avoid opening VI files from untrusted sources and report suspicious files to security teams. Within 7 days: Implement technical controls restricting VI file execution via application hardening, disabling file-open features where feasible, or requiring administrator approval; conduct mandatory security awareness training for engineering staff on social engineering and file-based attack vectors. Within 30 days: Deploy endpoint detection and response (EDR) monitoring for memory corruption exploitation patterns; coordinate with NI support on patch availability and timeline; evaluate LabVIEW upgrade paths or alternative tools if patch timeline extends beyond organizational risk tolerance.

NI LabVIEW CVE-2026-16233

Q: What is the CVSS score of CVE-2026-16233?

CVE-2026-16233 has a CVSS 4.0 base score of 8.5 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-65582 HIGH

Out-of-bounds Write (CWE-787)

2026-08-25 NI

GHSA-p3x9-7mrv-5rx5

Information Disclosure Memory Corruption Buffer Overflow RCE Labview

8.5

CVSS 4.0 · Vendor: NI

Severity by source

Vendor (NI) PRIMARY

8.5 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.8 HIGH

Local file-open trigger (AV:L), no special conditions (AC:L), no privileges required (PR:N), user must open file (UI:R), full triad impact with no scope change.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (NI).

CVSS VectorVendor: NI

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Patch available

Aug 25, 2026 - 18:17 EUVD

Analysis Updated

Aug 25, 2026 - 17:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 25, 2026 - 17:22 vuln.today

cvss_changed

CVSS changed

Aug 25, 2026 - 17:22 NVD

7.8 (HIGH) 8.5 (HIGH)

Analysis Generated

Aug 25, 2026 - 17:07 vuln.today

CVE Published

Aug 25, 2026 - 16:28 cve.org

HIGH 7.8

DescriptionCVE.org

There is a memory corruption vulnerability recently discovered in NI LabVIEW that may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted VI. This vulnerability affects NI LabVIEW 2026 Q3 (26.3.0) and prior versions.

AnalysisAI

Memory corruption in NI LabVIEW 2026 Q3 (26.3.0) and all prior versions enables information disclosure or arbitrary code execution when a user opens a specially crafted Virtual Instrument (VI) file. The CWE-787 out-of-bounds write root cause combined with the high-impact CVSS 4.0 score of 8.5 places this in a serious tier for LabVIEW deployments across engineering, scientific, and industrial automation environments. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires that a user be induced to open a specially crafted VI file using a vulnerable version of NI LabVIEW (26.3.0 or earlier). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) scores 8.5, reflecting a local attack vector with low complexity, no privilege requirement, but mandatory user interaction. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	The primary remediation is to consult and apply the update referenced in the NI security advisory at https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/2026/memory-corruption-vulnerabilities-ni-labview.html. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: Identify all LabVIEW 2026 Q3 and earlier deployments across the organization; issue urgent security alert to users instructing them to avoid opening VI files from untrusted sources and report suspicious files to security teams. …

Threat intelligence, references, and detailed analysis are available after sign-in.