Labview EUVD-2026-19908

The victim must open a specially crafted VI (LabVIEW) file in NI LabVIEW 2026 Q1 (26.1.0) or earlier versions. No authentication required; attacker must convince user to open malicious file. Local execution context.

The CVSS 4.0 score of 8.5 (High severity) reflects elevated confidentiality, integrity, and availability impact (VC:H/VI:H/VA:H) balanced against required user interaction (UI:P) and local attack vector (AV:L). Low attack complexity (AC:L) and no privilege requirements (PR:N) mean any local user can trigger exploitation by opening a weaponized VI file, making social engineering the primary attack prerequisite. No EPSS data is available for risk probability quantification, and no public exploit identified at time of analysis limits immediate weaponization risk. However, the dual-impact nature-information disclosure AND code execution-creates significant risk in environments where LabVIEW processes untrusted VI files from external sources, collaboration platforms, or email attachments. The SSVC framework would likely categorize this as requiring scheduled remediation due to local-only exploitation and lack of observed active exploitation, though organizations in high-value engineering or research sectors handling sensitive intellectual property should prioritize more aggressively. The vendor's public advisory demonstrates responsible disclosure, reducing but not eliminating window of exposure before patches are universally applied.

An attacker crafts a malicious LabVIEW VI file containing specially formatted data structures that trigger the out-of-bounds read in mgcore_SH_25_3!aligned_free() during file parsing. The attacker distributes this file via email to engineers at a target organization, disguised as a legitimate test configuration or instrument control program. When the victim opens the VI file in LabVIEW, the memory corruption occurs-either leaking sensitive process memory containing intellectual property, credentials, or cryptographic keys through the out-of-bounds read, or achieving arbitrary code execution by carefully controlling the corrupted memory region to hijack control flow. Given the local attack vector and low complexity, successful exploitation requires only social engineering to convince the user to open the file, with no authentication barriers or complex preconditions.