This vulnerability (CVE-2026-32860) involves an out-of-bounds write (CWE-787) in NI LabVIEW triggered by loading a corrupted LVLIB file. The flaw can cause memory corruption, potentially allowing an attacker to disclose sensitive information or execute arbitrary code. The vulnerability affects NI LabVIEW versions up to and including 26.1.0 (2026 Q1). Exploitation requires that a user open a maliciously crafted LVLIB file. The CVSS 3.1 base score is 7.8, reflecting high severity with local attack vector, low attack complexity, no privileges required, user interaction needed, and impacts on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available.

Successful exploitation can lead to information disclosure or arbitrary code execution on affected systems running NI LabVIEW up to version 26.1.0. The attacker must convince a user to open a specially crafted LVLIB file, which may result in full compromise of the affected application context. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should avoid opening LVLIB files from untrusted or unknown sources to reduce risk. Monitor NI's official channels for updates regarding fixes or workarounds.