NI LabVIEW CVE-2026-18444

Exploitation requires a user to actively open a specially crafted VI file in NI LabVIEW 2026 Q3 or an earlier version - this is the sole triggering condition per the vendor description and is reflected in UI:R in the CVSS vector. The attack vector is local (AV:L), meaning the malicious file must be present on the user's file system or a locally mounted share at the time of opening; direct network exploitation without file delivery is not applicable. No attacker privilege on the target system is required (PR:N). Key limiting factors: the attacker must successfully deliver the crafted VI file to a LabVIEW user and convince that user to open it, making social engineering a prerequisite; exploitation is further constrained to systems running LabVIEW 2026 Q3 or earlier, and the outcome of code execution versus crash depends on memory layout conditions not fully characterised by available data.

The CVSS 3.1 base score of 6.6 (Medium) reflects a local, user-interaction-dependent attack with high availability impact and limited confidentiality and integrity impact. The vector AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H indicates low attack complexity once the file is delivered, but the requirement for local execution and active user interaction materially constrains the practical attack surface. The most likely outcome is an application crash (A:H), with information disclosure (C:L) and code execution (I:L) representing escalated but less certain outcomes. No EPSS score was provided in the source data, and the vulnerability is absent from the CISA KEV catalog, indicating no confirmed active exploitation at time of analysis. The tags RCE and Information Disclosure align with the description but should be treated as potential worst-case outcomes rather than confirmed exploitation primitives - no POC has been publicly identified. Overall, this is a real but narrowly scoped vulnerability: impactful if weaponized against a specific LabVIEW operator through spear-phishing or malicious file distribution, but not a mass-exploitation risk given the specialized user base and UI:R constraint.

An attacker crafts a VI file embedding a malformed image designed to trigger the signed-to-unsigned conversion error, then delivers it to a LabVIEW user via a spear-phishing email, shared network drive, or a compromised project repository. When the victim opens the file in LabVIEW, the out-of-bounds read occurs during image parsing, potentially leaking memory contents or redirecting execution flow to attacker-controlled code. No public proof-of-concept has been identified, so the practical reliability of achieving code execution versus a crash remains unconfirmed.