NI LabVIEW CVE-2026-64201

Exploitation has exactly one trigger condition: a user must open a specially crafted VI (Virtual Instrument) file in an affected version of NI LabVIEW (26.3.0 or earlier). The CVSS 4.0 metric UI:P confirms this passive user interaction is mandatory - the vulnerability cannot be triggered without the file-open action. AV:L confirms the attacker must first deliver the file to a system where LabVIEW is installed; direct network exploitation without file delivery is not possible per the vector. PR:N confirms the attacker requires no privileges on the target system. Exploitation is further limited to hosts with NI LabVIEW installed, and no scope change occurs (SC:N/SI:N/SA:N), meaning lateral movement to other systems is not a direct consequence of the vulnerability itself.

The CVSS 4.0 vector AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N yields a base score of 8.5. AV:L confirms the attack requires local file delivery rather than direct network reachability, which reduces opportunistic exploitation relative to network-exposed flaws. UI:P confirms a user action (opening the file) is mandatory. The triply-high impact metrics VC:H/VI:H/VA:H indicate that successful exploitation can fully compromise the targeted system. No KEV listing means active exploitation is not confirmed by CISA. No EPSS data was provided, so exploitation probability cannot be quantified. POC availability is unknown. In context, LabVIEW is prevalent in engineering, scientific research, and industrial control environments; a targeted spear-phishing campaign delivering a malicious VI file to an ICS operator or researcher represents a realistic and high-consequence attack path, despite the absence of confirmed in-the-wild activity.

An attacker crafts a malicious LabVIEW VI file embedding out-of-bounds read triggers and delivers it to a target engineer or ICS operator via spear-phishing email or a compromised file share. When the victim opens the VI in LabVIEW, the parser reads beyond allocated buffer boundaries, causing memory corruption that can lead to disclosure of sensitive in-memory data or, with sufficient control over the corruption, arbitrary code execution under the user's privileges. No public proof-of-concept code has been identified at time of analysis.