Labview
Monthly
Memory corruption in NI LabVIEW 2026 Q3 (26.3.0) and all prior versions enables information disclosure or arbitrary code execution when a victim opens a specially crafted VI (Virtual Instrument) file. The root cause is CWE-787 (Out-of-bounds Write), indicating a write operation beyond the bounds of an allocated buffer during VI file parsing. No public exploit code or active exploitation has been identified at time of analysis, but the file-borne delivery model is realistic in engineering and research environments where LabVIEW projects are routinely shared.
Memory corruption in NI LabVIEW 2026 Q3 (26.3.0) and all prior versions enables information disclosure or arbitrary code execution when a user opens a specially crafted Virtual Instrument (VI) file. The root cause is an out-of-bounds read (CWE-125) that, combined with tags indicating buffer overflow behavior, can corrupt memory state sufficient to achieve code execution. No public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS 4.0 score of 8.5 reflects the high impact potential once a victim opens a malicious VI file.
Memory corruption in NI LabVIEW 2026 Q3 (26.3.0) and all prior versions enables information disclosure or arbitrary code execution when a user opens a specially crafted Virtual Instrument (VI) file. Rooted in CWE-125 (Out-of-bounds Read), the parser reads beyond allocated buffer boundaries, which can expose adjacent memory or - under favorable heap conditions - enable full code execution. No public exploit or CISA KEV listing has been identified at time of analysis, though the RCE potential and broad LabVIEW user base warrant prioritized patching.
Memory corruption in NI LabVIEW (all versions through 26.3.0) enables information disclosure or arbitrary code execution when a user opens a specially crafted VI (Virtual Instrument) file. The CVSS 4.0 base score of 8.5 reflects high impact across confidentiality, integrity, and availability on the vulnerable system, with local file-based delivery requiring passive user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, though the RCE potential and industrial control / engineering deployment context warrant prompt patching.
Memory corruption in NI LabVIEW 26.3.0 and all prior versions enables information disclosure or arbitrary code execution when a user opens a specially crafted Virtual Instrument (VI) file. Classified under CWE-125 (Out-of-bounds Read), the flaw's buffer-overflow and RCE tags suggest that the out-of-bounds read condition can, under certain memory layout circumstances, corrupt control-flow data and escalate beyond information disclosure to full code execution. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis; NI has published a vendor security advisory.
Memory corruption in NI LabVIEW 2026 Q3 (26.3.0) and all prior versions enables information disclosure or arbitrary code execution when a user opens a specially crafted Virtual Instrument (VI) file. The CWE-787 out-of-bounds write root cause combined with the high-impact CVSS 4.0 score of 8.5 places this in a serious tier for LabVIEW deployments across engineering, scientific, and industrial automation environments. No public exploit code has been identified at time of analysis, but the user-interaction trigger (social engineering via malicious VI file) is a well-understood threat model for desktop engineering tools.
Integer overflow leading to out-of-bounds write in NI LabVIEW 2026 Q3 and prior enables information disclosure or arbitrary code execution when a user opens a specially crafted VI file. The attack is file-based and requires social engineering to deliver a malicious Virtual Instrument file to a target, making it a credible threat in engineering, research, and industrial automation environments where VI files are routinely shared. No public exploit identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Out-of-bounds read in NI LabVIEW 2026 Q3 and all prior versions can result in information disclosure or arbitrary code execution when the application processes a maliciously crafted VI file containing a specially structured image. The root cause is a signed-to-unsigned integer conversion error (CWE-195) in the image-loading code path, causing the parser to read beyond intended memory boundaries. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Memory corruption via out-of-bounds read in NI LabVIEW's mgcore_SH_25_3!aligned_free() function enables information disclosure or arbitrary code execution when users open maliciously crafted VI files. Affects LabVIEW 2026 Q1 (26.1.0) and all prior versions. CVSS 8.5 severity stems from local attack vector requiring user interaction but no authentication. No public exploit identified at time of analysis, though the vendor advisory confirms the vulnerability's existence and technical details.
Memory corruption in NI LabVIEW 26.1.0 and earlier allows local attackers to execute arbitrary code or disclose sensitive information via maliciously crafted VI files. The vulnerability stems from an out-of-bounds read in sentry_transaction_context_set_operation(), requiring user interaction to open a specially crafted file. CVSS 8.5 (High) with local attack vector and low complexity. No public exploit identified at time of analysis, and EPSS data not available for this recently published CVE.
Memory corruption in NI LabVIEW's ResFileFactory::InitResourceMgr() function allows arbitrary code execution or information disclosure when users open malicious VI files. Affects LabVIEW 2026 Q1 (26.1.0) and all prior versions. CVSS 8.5 severity reflects high impact potential, though exploitation requires user interaction to open a crafted file. No public exploit identified at time of analysis, with EPSS data unavailable for this recently assigned CVE. Local attack vector limits remote exploitation scenarios.
Memory corruption via out-of-bounds write in NI LabVIEW allows arbitrary code execution and information disclosure when processing maliciously crafted .lvclass files. Affects LabVIEW 2026 Q1 (26.1.0) and all prior versions. Attack requires local access and user interaction to open the weaponized file (CVSS AV:L/UI:P). No public exploit identified at time of analysis, though the vendor advisory confirms the vulnerability and provides remediation guidance.
Memory corruption via out-of-bounds write in NI LabVIEW allows arbitrary code execution when processing malicious LVLIB files. Affects LabVIEW 2026 Q1 (26.1.0) and all prior versions. Attack requires local access and user interaction to open a specially crafted .lvlib project library file (CVSS 8.5, AV:L/PR:N/UI:P). No public exploit identified at time of analysis. EPSS data not available, but the local attack vector and user interaction requirement significantly limit immediate mass exploitation risk despite high CVSS score.
Out of bounds write vulnerability due to improper bounds checking in NI LabVIEW reading CPU info from cache that may result in information disclosure or arbitrary code execution. Rated high severity (CVSS 8.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Out of bounds write vulnerability due to improper bounds checking in NI LabVIEW in InitCPUInformation() that may result in information disclosure or arbitrary code execution. Rated high severity (CVSS 8.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
There is a DLL hijacking vulnerability due to an uncontrolled search path that exists in NI LabVIEW. Rated high severity (CVSS 7.0), this vulnerability is low attack complexity. No vendor patch available.
There is a DLL hijacking vulnerability due to an uncontrolled search path that exists in NI LabVIEW when loading NI Error Reporting. Rated high severity (CVSS 7.0), this vulnerability is low attack complexity. No vendor patch available.
An out of bounds read due to improper input validation in BuildFontMap in fontmgr.cpp in NI LabVIEW may disclose information or result in arbitrary code execution. Rated high severity (CVSS 8.4), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
An out of bounds read due to improper input validation when loading the font table in fontmgr.cpp in NI LabVIEW may disclose information or result in arbitrary code execution. Rated high severity (CVSS 8.4), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
An out of bounds read due to improper input validation in HeapObjMapImpl.cpp in NI LabVIEW may disclose information or result in arbitrary code execution. Rated high severity (CVSS 8.4), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
A memory corruption issue due to an improper length check in NI LabVIEW may disclose information or result in arbitrary code execution. Rated high severity (CVSS 8.4), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
A memory corruption issue due to an improper length check in LabVIEW tdcore.dll may disclose information or result in arbitrary code execution. Rated high severity (CVSS 8.4), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
An out of bounds read due to a missing bounds check in LabVIEW may disclose information or result in arbitrary code execution. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
An integer overflow vulnerability due to improper input validation when reading TDMS files in LabVIEW may result in an infinite loop. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
An improper error handling vulnerability in LabVIEW may result in remote code execution. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
An out of bounds write due to a missing bounds check in LabVIEW may result in remote code execution. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
An out of bounds write due to a missing bounds check in LabVIEW may result in remote code execution. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This Out-of-bounds Write vulnerability could allow attackers to write data beyond allocated buffer boundaries leading to code execution or crashes.
An improper error handling vulnerability in LabVIEW may result in remote code execution. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
An out of bounds write due to a missing bounds check in LabVIEW may result in remote code execution. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This Out-of-bounds Write vulnerability could allow attackers to write data beyond allocated buffer boundaries leading to code execution or crashes.
There is a cross-site scripting (XSS) vulnerability in an NI Web Server component installed with several NI products. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
An exploitable memory corruption vulnerability exists in the RSRC segment parsing functionality of LabVIEW 2017, LabVIEW 2016, LabVIEW 2015, and LabVIEW 2014. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
An exploitable memory corruption vulnerability exists in the LvVariantUnflatten functionality in 64-bit versions of LabVIEW before 2015 SP1 f7 Patch and 2016 before f2 Patch. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
The ActiveX controls in the HelpAsst component in NI Help Links in National Instruments LabWindows/CVI 2012 SP1 and earlier, LabVIEW 2012 SP1 and earlier, and other products allow remote attackers to. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
Absolute path traversal vulnerability in the 3D Graph ActiveX control in cw3dgrph.ocx in National Instruments LabWindows/CVI 2012 SP1 and earlier, LabVIEW 2012 SP1 and earlier, and other products. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity.
Multiple absolute path traversal vulnerabilities in National Instruments cwui.ocx, as used in National Instruments LabWindows/CVI 2012 SP1 and earlier, National Instruments LabVIEW 2012 SP1 and. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. No vendor patch available.
Memory corruption in NI LabVIEW 2026 Q3 (26.3.0) and all prior versions enables information disclosure or arbitrary code execution when a victim opens a specially crafted VI (Virtual Instrument) file. The root cause is CWE-787 (Out-of-bounds Write), indicating a write operation beyond the bounds of an allocated buffer during VI file parsing. No public exploit code or active exploitation has been identified at time of analysis, but the file-borne delivery model is realistic in engineering and research environments where LabVIEW projects are routinely shared.
Memory corruption in NI LabVIEW 2026 Q3 (26.3.0) and all prior versions enables information disclosure or arbitrary code execution when a user opens a specially crafted Virtual Instrument (VI) file. The root cause is an out-of-bounds read (CWE-125) that, combined with tags indicating buffer overflow behavior, can corrupt memory state sufficient to achieve code execution. No public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS 4.0 score of 8.5 reflects the high impact potential once a victim opens a malicious VI file.
Memory corruption in NI LabVIEW 2026 Q3 (26.3.0) and all prior versions enables information disclosure or arbitrary code execution when a user opens a specially crafted Virtual Instrument (VI) file. Rooted in CWE-125 (Out-of-bounds Read), the parser reads beyond allocated buffer boundaries, which can expose adjacent memory or - under favorable heap conditions - enable full code execution. No public exploit or CISA KEV listing has been identified at time of analysis, though the RCE potential and broad LabVIEW user base warrant prioritized patching.
Memory corruption in NI LabVIEW (all versions through 26.3.0) enables information disclosure or arbitrary code execution when a user opens a specially crafted VI (Virtual Instrument) file. The CVSS 4.0 base score of 8.5 reflects high impact across confidentiality, integrity, and availability on the vulnerable system, with local file-based delivery requiring passive user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, though the RCE potential and industrial control / engineering deployment context warrant prompt patching.
Memory corruption in NI LabVIEW 26.3.0 and all prior versions enables information disclosure or arbitrary code execution when a user opens a specially crafted Virtual Instrument (VI) file. Classified under CWE-125 (Out-of-bounds Read), the flaw's buffer-overflow and RCE tags suggest that the out-of-bounds read condition can, under certain memory layout circumstances, corrupt control-flow data and escalate beyond information disclosure to full code execution. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis; NI has published a vendor security advisory.
Memory corruption in NI LabVIEW 2026 Q3 (26.3.0) and all prior versions enables information disclosure or arbitrary code execution when a user opens a specially crafted Virtual Instrument (VI) file. The CWE-787 out-of-bounds write root cause combined with the high-impact CVSS 4.0 score of 8.5 places this in a serious tier for LabVIEW deployments across engineering, scientific, and industrial automation environments. No public exploit code has been identified at time of analysis, but the user-interaction trigger (social engineering via malicious VI file) is a well-understood threat model for desktop engineering tools.
Integer overflow leading to out-of-bounds write in NI LabVIEW 2026 Q3 and prior enables information disclosure or arbitrary code execution when a user opens a specially crafted VI file. The attack is file-based and requires social engineering to deliver a malicious Virtual Instrument file to a target, making it a credible threat in engineering, research, and industrial automation environments where VI files are routinely shared. No public exploit identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Out-of-bounds read in NI LabVIEW 2026 Q3 and all prior versions can result in information disclosure or arbitrary code execution when the application processes a maliciously crafted VI file containing a specially structured image. The root cause is a signed-to-unsigned integer conversion error (CWE-195) in the image-loading code path, causing the parser to read beyond intended memory boundaries. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Memory corruption via out-of-bounds read in NI LabVIEW's mgcore_SH_25_3!aligned_free() function enables information disclosure or arbitrary code execution when users open maliciously crafted VI files. Affects LabVIEW 2026 Q1 (26.1.0) and all prior versions. CVSS 8.5 severity stems from local attack vector requiring user interaction but no authentication. No public exploit identified at time of analysis, though the vendor advisory confirms the vulnerability's existence and technical details.
Memory corruption in NI LabVIEW 26.1.0 and earlier allows local attackers to execute arbitrary code or disclose sensitive information via maliciously crafted VI files. The vulnerability stems from an out-of-bounds read in sentry_transaction_context_set_operation(), requiring user interaction to open a specially crafted file. CVSS 8.5 (High) with local attack vector and low complexity. No public exploit identified at time of analysis, and EPSS data not available for this recently published CVE.
Memory corruption in NI LabVIEW's ResFileFactory::InitResourceMgr() function allows arbitrary code execution or information disclosure when users open malicious VI files. Affects LabVIEW 2026 Q1 (26.1.0) and all prior versions. CVSS 8.5 severity reflects high impact potential, though exploitation requires user interaction to open a crafted file. No public exploit identified at time of analysis, with EPSS data unavailable for this recently assigned CVE. Local attack vector limits remote exploitation scenarios.
Memory corruption via out-of-bounds write in NI LabVIEW allows arbitrary code execution and information disclosure when processing maliciously crafted .lvclass files. Affects LabVIEW 2026 Q1 (26.1.0) and all prior versions. Attack requires local access and user interaction to open the weaponized file (CVSS AV:L/UI:P). No public exploit identified at time of analysis, though the vendor advisory confirms the vulnerability and provides remediation guidance.
Memory corruption via out-of-bounds write in NI LabVIEW allows arbitrary code execution when processing malicious LVLIB files. Affects LabVIEW 2026 Q1 (26.1.0) and all prior versions. Attack requires local access and user interaction to open a specially crafted .lvlib project library file (CVSS 8.5, AV:L/PR:N/UI:P). No public exploit identified at time of analysis. EPSS data not available, but the local attack vector and user interaction requirement significantly limit immediate mass exploitation risk despite high CVSS score.
Out of bounds write vulnerability due to improper bounds checking in NI LabVIEW reading CPU info from cache that may result in information disclosure or arbitrary code execution. Rated high severity (CVSS 8.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Out of bounds write vulnerability due to improper bounds checking in NI LabVIEW in InitCPUInformation() that may result in information disclosure or arbitrary code execution. Rated high severity (CVSS 8.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
There is a DLL hijacking vulnerability due to an uncontrolled search path that exists in NI LabVIEW. Rated high severity (CVSS 7.0), this vulnerability is low attack complexity. No vendor patch available.
There is a DLL hijacking vulnerability due to an uncontrolled search path that exists in NI LabVIEW when loading NI Error Reporting. Rated high severity (CVSS 7.0), this vulnerability is low attack complexity. No vendor patch available.
An out of bounds read due to improper input validation in BuildFontMap in fontmgr.cpp in NI LabVIEW may disclose information or result in arbitrary code execution. Rated high severity (CVSS 8.4), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
An out of bounds read due to improper input validation when loading the font table in fontmgr.cpp in NI LabVIEW may disclose information or result in arbitrary code execution. Rated high severity (CVSS 8.4), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
An out of bounds read due to improper input validation in HeapObjMapImpl.cpp in NI LabVIEW may disclose information or result in arbitrary code execution. Rated high severity (CVSS 8.4), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
A memory corruption issue due to an improper length check in NI LabVIEW may disclose information or result in arbitrary code execution. Rated high severity (CVSS 8.4), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
A memory corruption issue due to an improper length check in LabVIEW tdcore.dll may disclose information or result in arbitrary code execution. Rated high severity (CVSS 8.4), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
An out of bounds read due to a missing bounds check in LabVIEW may disclose information or result in arbitrary code execution. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
An integer overflow vulnerability due to improper input validation when reading TDMS files in LabVIEW may result in an infinite loop. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
An improper error handling vulnerability in LabVIEW may result in remote code execution. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
An out of bounds write due to a missing bounds check in LabVIEW may result in remote code execution. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
An out of bounds write due to a missing bounds check in LabVIEW may result in remote code execution. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This Out-of-bounds Write vulnerability could allow attackers to write data beyond allocated buffer boundaries leading to code execution or crashes.
An improper error handling vulnerability in LabVIEW may result in remote code execution. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
An out of bounds write due to a missing bounds check in LabVIEW may result in remote code execution. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This Out-of-bounds Write vulnerability could allow attackers to write data beyond allocated buffer boundaries leading to code execution or crashes.
There is a cross-site scripting (XSS) vulnerability in an NI Web Server component installed with several NI products. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
An exploitable memory corruption vulnerability exists in the RSRC segment parsing functionality of LabVIEW 2017, LabVIEW 2016, LabVIEW 2015, and LabVIEW 2014. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
An exploitable memory corruption vulnerability exists in the LvVariantUnflatten functionality in 64-bit versions of LabVIEW before 2015 SP1 f7 Patch and 2016 before f2 Patch. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
The ActiveX controls in the HelpAsst component in NI Help Links in National Instruments LabWindows/CVI 2012 SP1 and earlier, LabVIEW 2012 SP1 and earlier, and other products allow remote attackers to. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
Absolute path traversal vulnerability in the 3D Graph ActiveX control in cw3dgrph.ocx in National Instruments LabWindows/CVI 2012 SP1 and earlier, LabVIEW 2012 SP1 and earlier, and other products. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity.
Multiple absolute path traversal vulnerabilities in National Instruments cwui.ocx, as used in National Instruments LabWindows/CVI 2012 SP1 and earlier, National Instruments LabVIEW 2012 SP1 and. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. No vendor patch available.