Which versions of Labview are affected by EUVD-2026-19906?

NI LabVIEW 26.1.0 and earlier contains a memory corruption vulnerability that enables local attackers to execute arbitrary code or access sensitive data through malicious VI files, posing a…. A patch is available.

How to fix or mitigate EUVD-2026-19906?

Within 24 hours: Inventory all systems running NI LabVIEW 26.1.0 and earlier; notify users to avoid opening VI files from untrusted sources. Within 7 days: Apply vendor-released patch to upgrade LabVIEW to version 26.2.0 or later across all affected systems; validate patch deployment through version verification commands. Within 30 days: Conduct post-patch testing of critical LabVIEW applications and document remediation completion for compliance records.

Labview EUVD-2026-19906

Q: What is the CVSS score of EUVD-2026-19906?

EUVD-2026-19906 has a CVSS 4.0 base score of 8.5 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-32863 HIGH

Out-of-bounds Read (CWE-125)

2026-04-07 NI

Information Disclosure Buffer Overflow RCE Labview

8.5

CVSS 4.0 · Vendor: NI

Severity by source

Vendor (NI) PRIMARY

8.5 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (NI) · only source for this CVE.

CVSS VectorVendor: NI

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:02 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

23.0.0,24.3.6,26.1.1

EUVD ID Assigned

Apr 07, 2026 - 20:16 euvd

EUVD-2026-19906

Analysis Generated

Apr 07, 2026 - 20:16 vuln.today

CVE Published

Apr 07, 2026 - 19:53 nvd

HIGH 8.5

DescriptionCVE.org

There is a memory corruption vulnerability due to an out-of-bounds read in sentry_transaction_context_set_operation() in NI LabVIEW. This vulnerability may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted VI file. This vulnerability affects NI LabVIEW 2026 Q1 (26.1.0) and prior versions.

AnalysisAI

Memory corruption in NI LabVIEW 26.1.0 and earlier allows local attackers to execute arbitrary code or disclose sensitive information via maliciously crafted VI files. The vulnerability stems from an out-of-bounds read in sentry_transaction_context_set_operation(), requiring user interaction to open a specially crafted file. CVSS 8.5 (High) with local attack vector and low complexity. No public exploit identified at time of analysis, and EPSS data not available for this recently published CVE.

Technical ContextAI

The vulnerability resides in LabVIEW's sentry_transaction_context_set_operation() function, which performs inadequate bounds checking when processing VI (Virtual Instrument) files. CWE-125 classification indicates an out-of-bounds read condition, where the application reads data past the end of an allocated buffer. LabVIEW VI files are proprietary binary formats used for graphical programming workflows in test, measurement, and control systems. When parsing malformed VI files, the vulnerable function attempts to read memory outside allocated regions, potentially exposing sensitive data from adjacent memory or causing control flow corruption leading to code execution. This affects NI LabVIEW products identified as cpe:2.3:a:ni:labview:*:*:*:*:*:*:*:* through version 26.1.0 (2026 Q1 release).

RemediationAI

Organizations should immediately review the NI security advisory at https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/2026/memory-corruption-vulnerabilities-in-ni-labview.html for patch availability and specific upgrade instructions. While exact patched version numbers are not specified in available data, NI typically releases updates through their software distribution channels. Until patches are applied, implement defense-in-depth measures including restricting execution of untrusted VI files, deploying application whitelisting to prevent unauthorized code execution, training users to avoid opening VI files from untrusted sources, and monitoring file execution activities in LabVIEW environments. Consider isolating LabVIEW systems from general network access where feasible to limit attack surface.