CVE-2026-16233: CWE-787 Out-of-bounds write in NI LabVIEW

This vulnerability, identified as CWE-787 (Out-of-bounds write), exists in NI LabVIEW and allows an attacker to cause memory corruption by tricking a user into opening a malicious VI file. Successful exploitation can result in information disclosure or arbitrary code execution. The CVSS 3.1 base score is 7.8, indicating high severity, with attack vector local, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability. The affected versions explicitly include 23.1.0, 24.1.0, 25.1.0, and 26.1.0, as well as all prior versions up to 26.3.0. There is no vendor advisory or patch link provided, and the remediation level is not specified.

An attacker who convinces a user to open a specially crafted VI file can exploit this vulnerability to execute arbitrary code or cause information disclosure. This can compromise the confidentiality, integrity, and availability of the affected system running NI LabVIEW. The attack requires local access and user interaction but no privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid opening untrusted VI files and apply general caution when handling files from unknown sources.