Labview EUVD-2026-19903

Attacker must trick a user into opening a malicious .VI (LabVIEW) file in NI LabVIEW 2026 Q1 (26.1.0) or earlier versions. The vulnerable ResFileFactory::InitResourceMgr() function processes the file, triggering out-of-bounds memory write. No authentication required; victim interaction is mandatory.

Real-world risk is moderate despite the high 8.5 CVSS score. The CVSS:4.0 vector (AV:L/AC:L/PR:N/UI:P) reveals critical constraints: local attack vector requires the malicious VI file to be delivered and opened on the target system, and user interaction is mandatory. Attack complexity is low once social engineering succeeds, and no privileges are required to exploit. The vulnerability is not confirmed actively exploited, with no CISA KEV listing or public exploit code identified. EPSS probability data is unavailable for this 2026-dated CVE, limiting quantitative exploitation likelihood assessment. From an SSVC perspective: exploitation status is none (no public evidence), technical impact is total (arbitrary code execution possible with confidentiality and integrity compromise per VC:H/VI:H), and automation potential is partial (requires user action to open files). Organizations using LabVIEW in high-security environments face elevated risk due to potential supply chain attacks via malicious VI files distributed through collaborative engineering projects or community code repositories. The information disclosure aspect compounds risk where proprietary algorithms or sensitive data exist in LabVIEW development environments. This is a legitimate security concern requiring timely patching, though not an imminent mass-exploitation threat like network-accessible vulnerabilities.

An attacker crafts a malicious LabVIEW VI file containing specially formed resource structures that trigger the out-of-bounds write in ResFileFactory::InitResourceMgr() during file parsing. The attacker distributes this file through social engineering-such as embedding it in a collaborative engineering project shared via email, posting it to LabVIEW community forums, or compromising a third-party VI library repository. When a LabVIEW user opens the malicious VI file to inspect or integrate the code, the memory corruption executes, potentially allowing the attacker to inject arbitrary code running with the privileges of the LabVIEW process, exfiltrate proprietary algorithms or measurement data from the development environment, or establish persistence for further system compromise. In industrial environments, this could lead to manipulation of control logic in automation systems if the compromised workstation is used for production deployments.