How to fix or mitigate EUVD-2026-19908?

Within 24 hours: Identify all LabVIEW installations across the organization and inventory current versions in use. Within 7 days: Apply vendor-released patch to LabVIEW 2026 Q1 (26.1.0) and all prior versions; obtain specific patched build version from NI advisory and deploy to all affected systems. Within 30 days: Conduct user awareness training on VI file provenance, implement file restriction policies for untrusted VI sources, and verify patch deployment completion across all engineering teams.

Labview EUVD-2026-19908

Q: What is the CVSS score of EUVD-2026-19908?

EUVD-2026-19908 has a CVSS 4.0 base score of 8.5 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

Q: Which versions of Labview are affected by EUVD-2026-19908?

CVE-2026-32864 is a memory corruption vulnerability in NI LabVIEW that allows attackers to execute arbitrary code or disclose sensitive information by tricking users into opening malicious VI files.. A patch is available.

| CVE-2026-32864 HIGH

Out-of-bounds Read (CWE-125)

2026-04-07 NI

Information Disclosure Buffer Overflow RCE Labview

8.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.5 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:02 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

24.3.6,26.1.1,25.3.4

EUVD ID Assigned

Apr 07, 2026 - 20:16 euvd

EUVD-2026-19908

Analysis Generated

Apr 07, 2026 - 20:16 vuln.today

CVE Published

Apr 07, 2026 - 19:56 nvd

HIGH 8.5

DescriptionCVE.org

There is a memory corruption vulnerability due to an out-of-bounds read in mgcore_SH_25_3!aligned_free() in NI LabVIEW. This vulnerability may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted VI file. This vulnerability affects NI LabVIEW 2026 Q1 (26.1.0) and prior versions.

AnalysisAI

Memory corruption via out-of-bounds read in NI LabVIEW's mgcore_SH_25_3!aligned_free() function enables information disclosure or arbitrary code execution when users open maliciously crafted VI files. Affects LabVIEW 2026 Q1 (26.1.0) and all prior versions. CVSS 8.5 severity stems from local attack vector requiring user interaction but no authentication. No public exploit identified at time of analysis, though the vendor advisory confirms the vulnerability's existence and technical details.

Technical ContextAI

This vulnerability resides in the mgcore_SH_25_3 module's aligned_free() function within NI LabVIEW, specifically classified as CWE-125 (Out-of-bounds Read). The flaw occurs during memory deallocation operations when processing LabVIEW Virtual Instrument (VI) files-the proprietary file format for LabVIEW programs containing graphical code, data flow diagrams, and embedded resources. Out-of-bounds read vulnerabilities allow attackers to access memory locations beyond allocated buffers, potentially leaking sensitive information from adjacent memory regions or triggering memory corruption that leads to code execution. The mgcore_SH_25_3 component likely handles core graphics or data structure management, making it critical to VI file parsing. The vulnerability affects the entire LabVIEW product line through version 26.1.0 per the CPE identifier cpe:2.3:a:ni:labview:*:*:*:*:*:*:*:*, indicating widespread exposure across National Instruments' engineering and scientific computing platform.

RemediationAI

Organizations should immediately upgrade to the patched version specified in the National Instruments security advisory available at https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/2026/memory-corruption-vulnerabilities-in-ni-labview.html, which addresses this memory corruption vulnerability. The exact fixed version number is available through the vendor advisory link. As an interim mitigation where immediate patching is not feasible, organizations should implement strict controls on VI file sources-prohibiting execution of VI files from untrusted origins, email attachments, or unverified collaboration platforms. Application whitelisting and user awareness training to prevent opening suspicious VI files provide defense-in-depth layers. Network segmentation isolating LabVIEW systems from internet-facing endpoints reduces social engineering attack surface. Organizations should inventory all LabVIEW installations to identify affected versions 26.1.0 and earlier, prioritizing systems processing external VI files or deployed in sensitive engineering environments.