10
CVEs
0
Critical
8
High
0
KEV
0
PoC
2
Unpatched C/H
80.0%
Patch Rate
0.1%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
8
MEDIUM
2
LOW
0
Monthly CVE Trend
Affected Products (29)
Labview
35
Dasylab
7
Grpc Device
7
Instrumentstudio
7
Circuit Design Suite
7
Veristand
6
Flexlogger
5
Systemlink
5
Ni Pal
4
Measurementstudio
4
Labwindows
4
Teststand
3
Systemlink Server
2
Diadem
2
Ni Service Locator
1
Vision Builder Ai
1
System Configuration
1
Redis
1
Python
1
G Web Development Software
1
Measurementlink
1
Datamanager
1
Compactrio Firmware
1
Labview Command Line Interface
1
Systemlink Enterprise
1
Lookout
1
Static Test Software Suite
1
Configuration Manager
1
Topografix Data Plugin
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-4129 | Improper access control in NI SystemLink and NI SystemLink Server (all versions through 26.5.0, 2026 Q3) allows a network-authenticated user with limited privileges to access host operating system files and directories that should be restricted. The root cause is CWE-862 (Missing Authorization) - the application authenticates the user but fails to enforce authorization boundaries between SystemLink application scope and the underlying host OS file system. No active exploitation or public proof-of-concept has been identified at time of analysis; the vulnerability is confirmed by NI's own security advisory. | HIGH | 8.6 | 0.2% | 43 |
No patch
|
| CVE-2026-16233 | Memory corruption in NI LabVIEW 2026 Q3 (26.3.0) and all prior versions enables information disclosure or arbitrary code execution when a user opens a specially crafted Virtual Instrument (VI) file. The CWE-787 out-of-bounds write root cause combined with the high-impact CVSS 4.0 score of 8.5 places this in a serious tier for LabVIEW deployments across engineering, scientific, and industrial automation environments. No public exploit code has been identified at time of analysis, but the user-interaction trigger (social engineering via malicious VI file) is a well-understood threat model for desktop engineering tools. | HIGH | 8.5 | 0.1% | 43 |
|
| CVE-2026-16234 | Memory corruption in NI LabVIEW 26.3.0 and all prior versions enables information disclosure or arbitrary code execution when a user opens a specially crafted Virtual Instrument (VI) file. Classified under CWE-125 (Out-of-bounds Read), the flaw's buffer-overflow and RCE tags suggest that the out-of-bounds read condition can, under certain memory layout circumstances, corrupt control-flow data and escalate beyond information disclosure to full code execution. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis; NI has published a vendor security advisory. | HIGH | 8.5 | 0.1% | 43 |
|
| CVE-2026-64201 | Memory corruption in NI LabVIEW (all versions through 26.3.0) enables information disclosure or arbitrary code execution when a user opens a specially crafted VI (Virtual Instrument) file. The CVSS 4.0 base score of 8.5 reflects high impact across confidentiality, integrity, and availability on the vulnerable system, with local file-based delivery requiring passive user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, though the RCE potential and industrial control / engineering deployment context warrant prompt patching. | HIGH | 8.5 | 0.1% | 43 |
|
| CVE-2026-64202 | Memory corruption in NI LabVIEW 2026 Q3 (26.3.0) and all prior versions enables information disclosure or arbitrary code execution when a user opens a specially crafted Virtual Instrument (VI) file. Rooted in CWE-125 (Out-of-bounds Read), the parser reads beyond allocated buffer boundaries, which can expose adjacent memory or - under favorable heap conditions - enable full code execution. No public exploit or CISA KEV listing has been identified at time of analysis, though the RCE potential and broad LabVIEW user base warrant prioritized patching. | HIGH | 8.5 | 0.1% | 43 |
|
| CVE-2026-64203 | Memory corruption in NI LabVIEW 2026 Q3 (26.3.0) and all prior versions enables information disclosure or arbitrary code execution when a user opens a specially crafted Virtual Instrument (VI) file. The root cause is an out-of-bounds read (CWE-125) that, combined with tags indicating buffer overflow behavior, can corrupt memory state sufficient to achieve code execution. No public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS 4.0 score of 8.5 reflects the high impact potential once a victim opens a malicious VI file. | HIGH | 8.5 | 0.1% | 43 |
|
| CVE-2026-64204 | Memory corruption in NI LabVIEW 2026 Q3 (26.3.0) and all prior versions enables information disclosure or arbitrary code execution when a victim opens a specially crafted VI (Virtual Instrument) file. The root cause is CWE-787 (Out-of-bounds Write), indicating a write operation beyond the bounds of an allocated buffer during VI file parsing. No public exploit code or active exploitation has been identified at time of analysis, but the file-borne delivery model is realistic in engineering and research environments where LabVIEW projects are routinely shared. | HIGH | 8.5 | 0.1% | 43 |
|
| CVE-2026-4130 | Cleartext storage of sensitive information in NI SystemLink and NI SystemLink Server (all versions through 2026 Q3, ≤26.5.0) allows a local low-privileged user to read credentials, API keys, or other secrets written to disk without encryption. The vulnerability is rooted in CWE-312 and carries a CVSS 4.0 score of 8.4, reflecting high confidentiality and integrity impact for local access. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV. | HIGH | 8.4 | 0.1% | 42 |
No patch
|
| CVE-2026-18444 | Out-of-bounds read in NI LabVIEW 2026 Q3 and all prior versions can result in information disclosure or arbitrary code execution when the application processes a maliciously crafted VI file containing a specially structured image. The root cause is a signed-to-unsigned integer conversion error (CWE-195) in the image-loading code path, causing the parser to read beyond intended memory boundaries. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. | MEDIUM | 6.9 | 0.1% | 35 |
|
| CVE-2026-18445 | Integer overflow leading to out-of-bounds write in NI LabVIEW 2026 Q3 and prior enables information disclosure or arbitrary code execution when a user opens a specially crafted VI file. The attack is file-based and requires social engineering to deliver a malicious Virtual Instrument file to a target, making it a credible threat in engineering, research, and industrial automation environments where VI files are routinely shared. No public exploit identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog. | MEDIUM | 6.9 | 0.1% | 35 |
|