Which versions of Labview are affected by CVE-2026-32860?

National Instruments LabVIEW versions 26.1.0 and earlier contain a memory corruption vulnerability in LVLIB file processing that enables arbitrary code execution when users open malicious project…. A patch is available.

How to fix or mitigate CVE-2026-32860?

Within 24 hours: Identify all systems running LabVIEW 26.1.0 or earlier and restrict file-opening permissions for LVLIB files to authorized personnel only. Within 7 days: Apply the vendor-released patch to upgrade LabVIEW to the latest patched version (confirm specific version number from National Instruments advisory). Within 30 days: Conduct user awareness training on the risks of opening unsolicited or untrusted LabVIEW project files and implement file-source validation procedures in development workflows.

Labview CVE-2026-32860

Q: What is the CVSS score of CVE-2026-32860?

CVE-2026-32860 has a CVSS 4.0 base score of 8.5 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-19899 HIGH

Out-of-bounds Write (CWE-787)

2026-04-07 NI

GHSA-xrvx-v68m-344q

Memory Corruption Information Disclosure Buffer Overflow RCE Labview

8.5

CVSS 4.0 · Vendor: NI

Severity by source

Vendor (NI) PRIMARY

8.5 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (NI) · only source for this CVE.

CVSS VectorVendor: NI

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:02 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

24.3.6,23.3.9,25.3.4

EUVD ID Assigned

Apr 07, 2026 - 20:16 euvd

EUVD-2026-19899

Analysis Generated

Apr 07, 2026 - 20:16 vuln.today

CVE Published

Apr 07, 2026 - 19:42 nvd

HIGH 8.5

DescriptionCVE.org

There is a memory corruption vulnerability due to an out-of-bounds write when loading a corrupted LVLIB file in NI LabVIEW. This vulnerability may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted .lvlib file. This vulnerability affects NI LabVIEW 2026 Q1 (26.1.0) and prior versions.

AnalysisAI

Memory corruption via out-of-bounds write in NI LabVIEW allows arbitrary code execution when processing malicious LVLIB files. Affects LabVIEW 2026 Q1 (26.1.0) and all prior versions. Attack requires local access and user interaction to open a specially crafted .lvlib project library file (CVSS 8.5, AV:L/PR:N/UI:P). No public exploit identified at time of analysis. EPSS data not available, but the local attack vector and user interaction requirement significantly limit immediate mass exploitation risk despite high CVSS score.

Technical ContextAI

This vulnerability stems from CWE-787 (Out-of-bounds Write) in NI LabVIEW's .lvlib file parser. LVLIB files are LabVIEW project library files containing references to VIs (Virtual Instruments) and project metadata. The out-of-bounds write occurs during parsing of malformed LVLIB file structures, allowing memory corruption beyond allocated buffer boundaries. This classic memory safety flaw in native code can overwrite adjacent memory regions, potentially hijacking control flow or leaking sensitive data from process memory. The affected CPE (cpe:2.3:a:ni:labview:*:*:*:*:*:*:*:*) indicates all LabVIEW versions through 2026 Q1 (26.1.0) contain vulnerable parsing code, suggesting a long-standing implementation issue in the LVLIB file format handler rather than a recent regression.

RemediationAI

Patch available per vendor advisory at https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/2026/lv-project-library-file-parsing-memory-corruption-vulnerability-in-ni-labview.html, though the specific fixed version number is not confirmed from available data. Organizations should immediately consult the NI security advisory to identify and deploy the recommended LabVIEW update that addresses the LVLIB parsing flaw. As an interim mitigation until patching is complete, implement strict controls on LVLIB file sources: prohibit opening project library files from untrusted origins, scan email attachments for .lvlib extensions, and educate LabVIEW users about the risks of opening unsolicited project files. Consider application whitelisting or file type blocking at email gateways to prevent delivery of potentially malicious LVLIB files. For air-gapped or legacy LabVIEW systems where immediate patching is not feasible, restrict LVLIB file operations to known-good project repositories with integrity verification.