Labview CVE-2026-32861

The victim must open a specially crafted .lvclass file in NI LabVIEW 2026 Q1 (26.1.0) or prior versions. Attacker delivers the malicious file; user interaction (opening file) is required. Local access needed to execute the file.

Real-world risk is moderate despite the high CVSS 8.5 score, requiring careful contextual assessment. The CVSS vector shows local attack vector (AV:L) with low complexity (AC:L) but mandatory user interaction (UI:P), meaning exploitation requires social engineering to convince a user to open a malicious .lvclass file-attackers cannot remotely trigger the vulnerability without user action. The high confidentiality, integrity, and availability impacts (VC:H/VI:H/VA:H) reflect the potential for code execution and information disclosure if exploitation succeeds. No public exploit code exists and the vulnerability is not listed in CISA KEV, indicating no confirmed active exploitation campaigns at this time. However, the technical barrier is relatively low once initial access is obtained, as creating a corrupted LVCLASS file with precise memory layout manipulation is within reach of moderately skilled attackers. Organizations using LabVIEW in high-value engineering environments (aerospace, defense, pharmaceutical manufacturing) should prioritize remediation due to the potential for intellectual property theft or sabotage of critical control systems, even though the attack requires user interaction. The lack of authentication requirements (PR:N) means any local user can trigger the vulnerability without elevated privileges.

An attacker targeting an engineering firm crafts a malicious .lvclass file containing carefully structured out-of-bounds write primitives designed to overwrite return addresses in LabVIEW's memory space. The file is delivered via spear-phishing email disguised as a legitimate project component or shared through a compromised collaboration platform used by the engineering team. When a developer opens the project containing the corrupted class file in LabVIEW, the parser triggers the memory corruption, allowing the attacker to execute arbitrary code with the privileges of the LabVIEW process. This could enable theft of proprietary control algorithms, exfiltration of intellectual property from active projects, or establishment of persistent access to the engineering network for industrial espionage or sabotage of manufacturing control systems.