Labview CVE-2026-32863

Attacker must craft a malicious VI file and convince a user to open it in NI LabVIEW 2026 Q1 (26.1.0) or earlier versions. The vulnerability triggers during VI file processing via sentry_transaction_context_set_operation() function.

Real-world risk is moderate-to-high despite the 8.5 CVSS score. The CVSS 4.0 vector shows local attack vector (AV:L) requiring user interaction (UI:P) but no privileges (PR:N), with high impact to confidentiality, integrity, and availability. Attack complexity is low (AC:L), making exploitation straightforward once an attacker delivers a malicious VI file. However, the local-only delivery requirement significantly limits exposure compared to network-based vulnerabilities. No EPSS score is available yet, and no public exploit code exists, reducing immediate risk. KEV status not confirmed. The primary attack surface is social engineering to convince users to open untrusted VI files-common in industrial/engineering environments where LabVIEW users frequently share instrument configurations. Organizations with strict file handling policies face lower risk. SSVC framework suggests medium priority: exploitation requires user interaction (not automatable), technical impact is high (RCE potential), but no evidence of active targeting. This is a legitimate concern for LabVIEW deployments but not a drop-everything emergency.

An attacker crafts a malicious LabVIEW VI file containing specially formatted data that triggers the out-of-bounds read in sentry_transaction_context_set_operation(). The attacker delivers this file via email, file sharing, or compromised download repositories targeting engineers, scientists, or technicians who regularly use LabVIEW for instrumentation control. When the victim opens the malicious VI file in LabVIEW, the out-of-bounds read executes, either leaking sensitive information from process memory (such as credentials or proprietary measurement data) or corrupting program state to achieve arbitrary code execution with the victim's privileges. The attacker gains control of the LabVIEW environment, potentially accessing connected test equipment, industrial control systems, or sensitive research data.