Ni Labview

NI LabVIEW 2026 Q1 (26.1.0) Memory Corruption in mgcore_SH_25_3!aligned_free
CVE-2026-32864 7.8 - High - April 07, 2026

There is a memory corruption vulnerability due to an out-of-bounds read in mgcore_SH_25_3!aligned_free() in NI LabVIEW.  This vulnerability may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted VI file. This vulnerability affects NI LabVIEW 2026 Q1 (26.1.0) and prior versions.

Out-of-bounds Read

NI LabVIEW 26.1.0 OOB Read in sentry_transaction_context_set_operation
CVE-2026-32863 7.8 - High - April 07, 2026

There is a memory corruption vulnerability due to an out-of-bounds read in sentry_transaction_context_set_operation() in NI LabVIEW.  This vulnerability may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted VI file. This vulnerability affects NI LabVIEW 2026 Q1 (26.1.0) and prior versions.

Out-of-bounds Read

NI LabVIEW Memory Corruption in ResFileFactory (before 26.1)
CVE-2026-32862 7.8 - High - April 07, 2026

There is a memory corruption vulnerability due to an out-of-bounds write in ResFileFactory::InitResourceMgr() in NI LabVIEW.  This vulnerability may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted VI file. This vulnerability affects NI LabVIEW 2026 Q1 (26.1.0) and prior versions.

Memory Corruption

Out-of-bounds Write in NI LabVIEW 26.1.0 LVCLASS Loader
CVE-2026-32861 7.8 - High - April 07, 2026

There is a memory corruption vulnerability due to an out-of-bounds write when loading a corrupted LVCLASS file in NI LabVIEW.  This vulnerability may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted .lvclass file. This vulnerability affects NI LabVIEW 2026 Q1 (26.1.0) and prior versions.

Memory Corruption

NI LabVIEW 2026 Q1 Memory corruption via LVLIB (CVE-2026-32860)
CVE-2026-32860 7.8 - High - April 07, 2026

There is a memory corruption vulnerability due to an out-of-bounds write when loading a corrupted LVLIB file in NI LabVIEW.  This vulnerability may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted .lvlib file. This vulnerability affects NI LabVIEW 2026 Q1 (26.1.0) and prior versions.

Memory Corruption

NI LabVIEW <25.3: Stack overflow in LVResFile::FindRsrcListEntry()
CVE-2025-64469 7.8 - High - December 18, 2025

There is a stack-based buffer overflow vulnerability in NI LabVIEW in LVResFile::FindRsrcListEntry() when parsing a corrupted VI file. This vulnerability may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted VI. This vulnerability affects NI LabVIEW 2025 Q3 (25.3) and prior versions.

Stack Overflow

NI LabVIEW 25.3 UAF in sentry!* Info leak via crafted VI
CVE-2025-64468 7.8 - High - December 18, 2025

There is a use-after-free vulnerability in sentry!sentry_span_set_data() when parsing a corrupted VI file. This vulnerability may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted VI. This vulnerability affects NI LabVIEW 2025 Q3 (25.3) and prior versions

Dangling pointer

NI LabVIEW OOB Read in LVResFile::FindRsrcListEntry() (pre-25.3)
CVE-2025-64467 7.8 - High - December 18, 2025

There is an out of bounds read vulnerability in NI LabVIEW in LVResFile::FindRsrcListEntry() when parsing a corrupted VI file. This vulnerability may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted VI. This vulnerability affects NI LabVIEW 2025 Q3 (25.3) and prior versions.

Out-of-bounds Read

NI LabVIEW OOB Read in lvre!ExecPostedProcRecPost() before 25.3
CVE-2025-64466 7.8 - High - December 18, 2025

There is an out of bounds read vulnerability in NI LabVIEW in lvre!ExecPostedProcRecPost() when parsing a corrupted VI file. This vulnerability may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted VI. This vulnerability affects NI LabVIEW 2025 Q3 (25.3) and prior versions.

Out-of-bounds Read

OOB Read in NI LabVIEW 25.3 via lvre!DataSizeTDR(): Info Disclosure & Code Exec
CVE-2025-64465 7.8 - High - December 18, 2025

There is an out of bounds read vulnerability in NI LabVIEW in lvre!DataSizeTDR() when parsing a corrupted VI file. This vulnerability may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted VI. This vulnerability affects NI LabVIEW 2025 Q3 (25.3) and prior versions.

Out-of-bounds Read

OOB Read in NI LabVIEW lvre!VisaWriteFromFile() Info Disclosure/CODE EXEC(25.3)
CVE-2025-64464 7.8 - High - December 18, 2025

There is an out of bounds read vulnerability in NI LabVIEW in lvre!VisaWriteFromFile() when parsing a corrupted VI file. This vulnerability may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted VI. This vulnerability affects NI LabVIEW 2025 Q3 (25.3) and prior versions.

Out-of-bounds Read

NI LabVIEW 25.3 & prior: OOB read in LVResource::DetachResource()
CVE-2025-64463 7.8 - High - December 18, 2025

There is an out of bounds read vulnerability in NI LabVIEW in LVResource::DetachResource() when parsing a corrupted VI file. This vulnerability may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted VI. This vulnerability affects NI LabVIEW 2025 Q3 (25.3) and prior versions.

Out-of-bounds Read

NI LabVIEW 25.3 OOB Read in LVResFile::RGetMemFileHandle() - Info disclosure
CVE-2025-64462 7.8 - High - December 18, 2025

There is an out of bounds read vulnerability in NI LabVIEW in LVResFile::RGetMemFileHandle() when parsing a corrupted VI file. This vulnerability may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted VI. This vulnerability affects NI LabVIEW 2025 Q3 (25.3) and prior versions.

Out-of-bounds Read

NI LabVIEW OOBV in mgocre_SH_25_3!RevBL() pre-25.3
CVE-2025-64461 7.8 - High - December 18, 2025

There is an out of bounds write vulnerability in NI LabVIEW in mgocre_SH_25_3!RevBL() when parsing a corrupted VI file. This vulnerability may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted VI. This vulnerability affects NI LabVIEW 2025 Q3 (25.3) and prior versions.

Memory Corruption

NI SWS Path Traversal Exposes Files
CVE-2025-12097 7.5 - High - December 04, 2025

There is a relative path traversal vulnerability in the NI System Web Server that may result in information disclosure.  Successful exploitation requires an attacker to send a specially crafted request to the NI System Web Server, allowing the attacker to read arbitrary files.  This vulnerability existed in the NI System Web Server 2012 and prior versions.  It was fixed in 2013.

Relative Path Traversal

NI LabVIEW RCE via NULL VILinkObj Mem Corruption
CVE-2025-7849 - July 29, 2025

A memory corruption vulnerability due to improper error handling when a VILinkObj is null exists in NI LabVIEW that may result in arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted VI. This vulnerability affects NI LabVIEW 2025 Q1 and prior versions.

NI LabVIEW RCE via lvpict.cpp memory corruption
CVE-2025-7848 - July 29, 2025

A memory corruption vulnerability due to improper input validation in lvpict.cpp exists in NI LabVIEW that may result in arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted VI. This vulnerability affects NI LabVIEW 2025 Q1 and prior versions.

NI LabVIEW 32-bit RCE via CIN Node Code Injection
CVE-2025-7361 - July 29, 2025

A code injection vulnerability due to an improper initialization check exists in NI LabVIEW that may result in arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted VI using a CIN node. This vulnerability affects 32-bit NI LabVIEW 2025 Q1 and prior versions. LabVIEW 64-bit versions do not support CIN nodes and are not affected.

Out-of-Bounds Read in NI LabVIEW fontmgr Enables RCE
CVE-2025-2634 - July 23, 2025

Out of bounds read vulnerability due to improper bounds checking in NI LabVIEW in fontmgr may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted VI. This vulnerability affects NI LabVIEW 2025 Q1 and prior versions.

NI LabVIEW OOB Read RCE via lvre!UDecStrToNum in VI
CVE-2025-2633 - July 23, 2025

Out of bounds read vulnerability due to improper bounds checking in NI LabVIEW in lvre!UDecStrToNum that may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted VI. This vulnerability affects NI LabVIEW 2025 Q1 and prior versions.

NI LabVIEW OOB Write in InitCPUInformation() leading to code exec
CVE-2025-2631 7.8 - High - April 09, 2025

Out of bounds write vulnerability due to improper bounds checking in NI LabVIEW in InitCPUInformation() that may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted VI. This vulnerability affects NI LabVIEW 2025 Q1 and prior versions.

NI LabVIEW OOB Write in CPU Cache Parsing - CVE-2025-2632
CVE-2025-2632 - April 09, 2025

Out of bounds write vulnerability due to improper bounds checking in NI LabVIEW reading CPU info from cache that may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted VI. This vulnerability affects NI LabVIEW 2025 Q1 and prior versions.

NI LabVIEW DLL Hijacking – Arbitrary Code Execution via Uncontrolled Search Path
CVE-2025-2629 7.8 - High - April 09, 2025

There is a DLL hijacking vulnerability due to an uncontrolled search path that exists in NI LabVIEW when loading NI Error Reporting. This vulnerability may result in arbitrary code execution. Successful exploitation requires an attacker to insert a malicious DLL into the uncontrolled search path. This vulnerability affects NI LabVIEW 2025 Q1 and prior versions.

NI LabVIEW DLL Hijacking via Uncontrolled Path – Arbitrary Exec
CVE-2025-2630 7.8 - High - April 09, 2025

There is a DLL hijacking vulnerability due to an uncontrolled search path that exists in NI LabVIEW. This vulnerability may result in arbitrary code execution. Successful exploitation requires an attacker to insert a malicious DLL into the uncontrolled search path. This vulnerability affects NI LabVIEW 2025 Q1 and prior versions.

NI LabVIEW HeapObjMapImpl Out-of-Bounds Read Vulnerability
CVE-2024-10494 7.8 - High - December 10, 2024

An out of bounds read due to improper input validation in HeapObjMapImpl.cpp in NI LabVIEW may disclose information or result in arbitrary code execution. Successful exploitation requires an attacker to provide a user with a specially crafted VI. This vulnerability affects LabVIEW 2024 Q3 and prior versions.

NI LabVIEW Font Table Out-of-Bounds Read Vulnerability
CVE-2024-10495 7.8 - High - December 10, 2024

An out of bounds read due to improper input validation when loading the font table in fontmgr.cpp in NI LabVIEW may disclose information or result in arbitrary code execution. Successful exploitation requires an attacker to provide a user with a specially crafted VI. This vulnerability affects LabVIEW 2024 Q3 and prior versions.

NI LabVIEW: Out-of-Bounds Read in BuildFontMap Function
CVE-2024-10496 7.8 - High - December 10, 2024

An out of bounds read due to improper input validation in BuildFontMap in fontmgr.cpp in NI LabVIEW may disclose information or result in arbitrary code execution. Successful exploitation requires an attacker to provide a user with a specially crafted VI. This vulnerability affects LabVIEW 2024 Q3 and prior versions.

NI LabVIEW 2024 Q1 Memory Corrupt in VI Enables Info Disclosure & Exec
CVE-2024-4081 7.8 - High - July 23, 2024

A memory corruption issue due to an improper length check in NI LabVIEW may disclose information or result in arbitrary code execution. Successful exploitation requires an attacker to provide a user with a specially crafted VI. This vulnerability affects NI LabVIEW 2024 Q1 and prior versions.

Memory Corruption

LabVIEW OOB Read/Exec via Crafted VI
CVE-2024-4079 7.8 - High - July 23, 2024

An out of bounds read due to a missing bounds check in LabVIEW may disclose information or result in arbitrary code execution. Successful exploitation requires an attacker to provide a user with a specially crafted VI. This vulnerability affects LabVIEW 2024 Q1 and prior versions.

Out-of-bounds Read

LabVIEW Memory Corruption in tdcore.dll Enables Remote Code Exec
CVE-2024-4080 7.8 - High - July 23, 2024

A memory corruption issue due to an improper length check in LabVIEW tdcore.dll may disclose information or result in arbitrary code execution. Successful exploitation requires an attacker to provide a user with a specially crafted VI. This vulnerability affects LabVIEW 2024 Q1 and prior versions.

Memory Corruption

LabVIEW TDMS Integer Overflow Infinite Loop Vulnerability
CVE-2024-6638 5.5 - Medium - July 22, 2024

An integer overflow vulnerability due to improper input validation when reading TDMS files in LabVIEW may result in an infinite loop. Successful exploitation requires an attacker to provide a user with a specially crafted TDMS file. This vulnerability affects LabVIEW 2024 Q1 and prior versions.

LabVIEW OOB Write leads to RCE via crafted VI
CVE-2024-23610 7.8 - High - March 11, 2024

An out of bounds write due to a missing bounds check in LabVIEW may result in remote code execution. Successful exploitation requires an attacker to provide a user with a specially crafted VI. This vulnerability affects LabVIEW 2024 Q1 and prior versions.

LabVIEW OOB Write Allows RCE via Crafted VI
CVE-2024-23611 7.8 - High - March 11, 2024

An out of bounds write due to a missing bounds check in LabVIEW may result in remote code execution. Successful exploitation requires an attacker to provide a user with a specially crafted VI. This vulnerability affects LabVIEW 2024 Q1 and prior versions.

There is a cross-site scripting (XSS) vulnerability in an NI Web Server component installed with several NI products
CVE-2022-27237 6.1 - Medium - April 21, 2022

There is a cross-site scripting (XSS) vulnerability in an NI Web Server component installed with several NI products. Depending on the product(s) in use, remediation guidance includes: install SystemLink version 2021 R3 or later, install FlexLogger 2022 Q2 or later, install LabVIEW 2021 SP1, install G Web Development 2022 R1 or later, or install Static Test Software Suite version 1.2 or later.

XSS

An exploitable memory corruption vulnerability exists in the RSRC segment parsing functionality of LabVIEW 2017
CVE-2017-2779 7.8 - High - September 05, 2017

An exploitable memory corruption vulnerability exists in the RSRC segment parsing functionality of LabVIEW 2017, LabVIEW 2016, LabVIEW 2015, and LabVIEW 2014. A specially crafted Virtual Instrument (VI) file can cause an attacker controlled looping condition resulting in an arbitrary null write. An attacker controlled VI file can be used to trigger this vulnerability and can potentially result in code execution.

Memory Corruption

An exploitable memory corruption vulnerability exists in the LvVariantUnflatten functionality in 64-bit versions of LabVIEW before 2015 SP1 f7 Patch and 2016 before f2 Patch
CVE-2017-2775 7.8 - High - March 31, 2017

An exploitable memory corruption vulnerability exists in the LvVariantUnflatten functionality in 64-bit versions of LabVIEW before 2015 SP1 f7 Patch and 2016 before f2 Patch. A specially crafted VI file can cause a user controlled value to be used as a loop terminator resulting in internal heap corruption. An attacker controlled VI file can be used to trigger this vulnerability, exploitation could lead to remote code execution.

Buffer Overflow