NI LabVIEW CVE-2026-16233

Exploitation requires that a user be induced to open a specially crafted VI file using a vulnerable version of NI LabVIEW (26.3.0 or earlier). The CVSS 4.0 vector confirms no privileges are required (PR:N) and no special system configuration beyond having a vulnerable LabVIEW installation present. The mandatory limiting factor is user interaction (UI:P) - the attack cannot be triggered remotely or automatically without the user explicitly opening the malicious file. This means exploitation is constrained to scenarios involving social engineering, phishing, or supply chain injection of malicious VI files (e.g., via community repositories, shared project archives, or instrument driver packages). There is no indication of a network-reachable attack surface; the vulnerability is in local file parsing, not a network service.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) scores 8.5, reflecting a local attack vector with low complexity, no privilege requirement, but mandatory user interaction. The local attack vector (AV:L) is accurate for a file-open trigger - the malicious VI must be delivered and opened on the victim's machine, which limits opportunistic mass exploitation but makes targeted spear-phishing a realistic vector in industrial and research contexts. Attack complexity is low once the file reaches the target (AC:L, AT:N), meaning no race condition or special timing is required. The high confidentiality, integrity, and availability impact to the vulnerable system is consistent with arbitrary code execution potential. No scope change (SC:N/SI:N/SA:N) means the compromise does not inherently propagate to adjacent systems, though a compromised LabVIEW workstation in an OT/ICS environment may have significant secondary exposure. Exploitation probability context: no EPSS score is available in the provided data, and this CVE is not listed in CISA KEV, suggesting no confirmed active exploitation at time of analysis. The user-interaction requirement (UI:P) meaningfully reduces the automated exploitability - this is not a wormable flaw. Risk is elevated in environments where LabVIEW users routinely exchange VI files with external collaborators or download community VI files.

An attacker targeting an engineer at a research facility crafts a malicious LabVIEW VI file that triggers the out-of-bounds write during parsing, then delivers it via email as a shared measurement project or instrument driver. When the engineer opens the file in LabVIEW, the memory corruption is triggered and the attacker's shellcode executes with the engineer's privileges, enabling credential theft, lateral movement, or persistent access to lab systems. No public exploit code has been identified at time of analysis, meaning this likely requires custom exploit development.