NI LabVIEW CVE-2026-18445

Exploitation requires the victim to manually open a specially crafted VI (Virtual Instrument) file using NI LabVIEW - confirmed by the vendor description and the CVSS UI:R metric. The attacker must first deliver the malicious file to the target system, typically via social engineering such as phishing, a shared network drive, or a poisoned project archive. The CVSS AV:L metric confirms the vulnerability is triggered within the local process when parsing the file, not via any exposed network service; remote exploitation over a network without user interaction is not possible. No authentication, elevated privileges, or non-default configuration is required on the attacker side (PR:N). Exploitation is limited to systems running NI LabVIEW 2026 Q3 or earlier, and the attack is bounded by the user's own privilege level (S:U - no privilege escalation beyond the current user context).

The CVSS 3.1 score of 6.6 with vector AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H reflects a moderate-severity, file-triggered local vulnerability. The High Availability impact reflects the likely crash condition from an uncontrolled out-of-bounds write; the Low Confidentiality and Integrity ratings acknowledge that code execution or information leakage is theoretically possible but not guaranteed. The AV:L designation is significant: the attack does not traverse a network service but executes within the local process context after the user opens a file - this substantially limits opportunistic mass exploitation. No EPSS score is provided in the available data, so probabilistic exploitation likelihood cannot be quantified. The vulnerability is absent from the CISA KEV catalog and no POC has been publicly identified, both signals pointing to lower immediate real-world exploitation risk. However, the industrial and research context of LabVIEW makes targeted spear-phishing with crafted VI files a realistic threat model, particularly in sectors where VI files are shared among collaborators via email or shared drives. The gap between 'possible RCE' and 'confirmed RCE reliability' is unknown without patch-diff analysis.

An attacker with knowledge of LabVIEW's VI file format crafts a malicious VI file embedding values engineered to trigger the integer overflow in the file parser, then delivers it to a target engineer or researcher via a phishing email or a compromised shared project repository. When the victim opens the file in LabVIEW, the overflow causes an out-of-bounds write that may crash the application or, under controlled conditions, allow the attacker to redirect execution and run arbitrary code with the victim's privileges. No public exploit code has been identified, but the file-based attack surface is well understood and the VI format is documented, making weaponization feasible for a motivated actor.