NI LabVIEW CVE-2026-64203

Exploitation requires that the target user have NI LabVIEW 2026 Q3 (26.3.0) or an earlier version installed and actively open a specially crafted VI file delivered by the attacker - this user interaction step (UI:P in the CVSS 4.0 vector) is a hard prerequisite. The attack vector is local (AV:L), meaning the VI file must be parsed by the LabVIEW runtime on the victim's machine; the attacker does not need network-level access to the target. No authentication or elevated privileges are required of the attacker. Exploitation is limited to systems running LabVIEW - it does not affect embedded LabVIEW RT targets or other NI products unless separately disclosed. The primary limiting factor is the social engineering step: a user must be induced to open an untrusted VI file, which is a realistic scenario in engineering environments where VI files are commonly exchanged between colleagues.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P) correctly captures this as a file-parsing attack: local execution context, low complexity, no privileges required by the attacker, but passive user interaction (opening a file) is mandatory. The high C/H, I/H, A/H impact metrics reflect the worst-case RCE scenario. In practice, exploitation is gated by the social engineering step of convincing a target engineer or researcher to open a malicious VI file - a meaningful but not prohibitive barrier in environments where VI files are routinely shared. No EPSS score was provided in the input, no KEV listing exists, and no POC has been identified, making this a high-severity but currently theoretical risk. The self-reporting by NI (vendor-disclosed) is a positive signal for patch availability, though an exact fix version was not confirmed in the provided data. The engineering and industrial sector nature of LabVIEW's user base means that compromise of an affected workstation could have downstream consequences in lab or manufacturing environments.

An attacker crafts a malicious VI file that triggers an out-of-bounds read in LabVIEW's file parser, corrupting memory in a way that redirects execution flow. The attacker delivers this file to a target engineer via email, a shared network drive, or a compromised collaboration platform, and persuades them to open it within LabVIEW. Upon opening, the memory corruption executes attacker-controlled code with the privileges of the LabVIEW process, potentially providing a foothold on a workstation connected to test equipment or industrial systems. No public POC has been identified at time of analysis.