NI LabVIEW CVE-2026-16234

Exploitation requires that a victim user open a specially crafted VI file using a vulnerable version of NI LabVIEW (26.3.0 or earlier). The attacker must deliver the malicious VI file to the victim through some out-of-band channel (email attachment, shared drive, download). No network service exposure is required - LabVIEW does not need to be listening on any port. No authentication to any system is required beyond the ability to place or send a file. Exploitation is limited by the mandatory user-interaction step (the user must actively open the file), the local attack vector (the file must execute within the LabVIEW process on the victim host), and the requirement that the victim is running a vulnerable LabVIEW version. Environments where LabVIEW is air-gapped and VI files are never introduced from external sources have substantially reduced exposure.

The CVSS 4.0 base score of 8.5 is driven by high vulnerable-system impacts (VC:H/VI:H/VA:H), but two mitigating metric choices substantially limit realistic exposure: AV:L (local attack vector - the crafted VI file must be opened on the victim machine) and UI:P (passive user interaction - the victim must open the file). This is not remotely exploitable in the traditional sense; exploitation requires a social engineering or supply-chain delivery step to place a malicious VI in front of a LabVIEW user. No EPSS score was provided in the input, and the absence of a CISA KEV listing means active in-the-wild exploitation is unconfirmed. The PR:N metric in the CVSS 4.0 vector is consistent with the delivery model - the attacker needs no privileges on the victim system, only the ability to deliver a file. The combination of high theoretical impact with a required delivery mechanism suggests this is a meaningful but not immediately critical priority for most organizations, provided controls exist around VI file provenance; environments that regularly receive VI files from external sources or untrusted parties face materially higher risk.

An attacker crafts a malformed VI file that triggers the out-of-bounds read in LabVIEW's file parser and delivers it to a target engineer via email, a shared network drive, or a compromised VI distribution channel. The engineer opens the file in LabVIEW as part of routine work, triggering memory corruption that the attacker has engineered to overwrite a function pointer or return address, resulting in execution of attacker-supplied shellcode under the LabVIEW process's privileges. No public proof-of-concept exploit code is identified at time of analysis, but the file-parsing nature of the vulnerability makes weaponization feasible for a moderately skilled adversary.