NI LabVIEW EUVD-2026-65591

Exploitation requires exactly one precondition: a LabVIEW user must open a specially crafted VI file using an affected version (26.3.0 or prior). The attacker requires no privileges on the target system and no prior authentication. Exploitation is bounded by the need for user interaction (UI:P) - the victim must actively open the malicious file - which introduces a social engineering dependency. The local attack vector (AV:L) means the VI file must be accessible on the local system at the time of opening, either via direct delivery (email attachment, USB, download) or a mounted network share. No specific LabVIEW configuration, add-on module, or non-default setting is named as a prerequisite in the CVE description. Exploitation is limited to users running an affected LabVIEW version who can be induced to open an untrusted VI file.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P) scores 8.5, reflecting high impact across confidentiality, integrity, and availability of the vulnerable system with no scope change to subsequent systems. The local attack vector limits exposure compared to network-exploitable flaws - the malicious VI must reach the target workstation - but AC:L and AT:N indicate no special conditions are required once delivery is achieved. No EPSS score was provided in the input data, preventing probability-based triage. Neither CISA KEV listing nor public POC code has been identified, which meaningfully reduces immediate urgency relative to a confirmed-exploited flaw of equal CVSS score. That said, LabVIEW environments commonly involve file sharing among engineers and collaborators, making phishing-style VI delivery a realistic attack path; even a mid-sized engineering or manufacturing organization should treat this as a timely patching priority rather than deferring to the next maintenance window. The absence of a scope change (SC:N/SI:N/SA:N) suggests exploitation is contained to the user's workstation, limiting lateral movement directly from the vulnerability itself.

An attacker crafts a malicious LabVIEW VI file engineered to trigger the out-of-bounds read during file parsing, then delivers it to a target engineer via a phishing email, a compromised shared file server, or a poisoned online LabVIEW resource repository. When the victim opens the VI in an unpatched LabVIEW installation, the memory corruption executes attacker-controlled code in the context of the user's session. No public POC has been identified at time of analysis, but the technique is consistent with well-understood file-format exploitation patterns.