This vulnerability (CWE-787) involves an out-of-bounds write in the ResFileFactory::InitResourceMgr() component of NI LabVIEW, which can cause memory corruption. Successful exploitation requires user interaction by opening a malicious VI file, which may allow an attacker to disclose sensitive information or execute arbitrary code with the privileges of the user running LabVIEW. The affected versions include all releases up to and including 26.1.0 (2026 Q1). The CVSS 3.1 base score is 7.8, indicating high severity, with attack vector local, low attack complexity, no privileges required, user interaction needed, and high impact on confidentiality, integrity, and availability.

If exploited, this vulnerability can lead to full compromise of the affected system through arbitrary code execution or information disclosure. The attacker must convince a user to open a crafted VI file to trigger the vulnerability. The impact affects confidentiality, integrity, and availability of the system running NI LabVIEW.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid opening VI files from untrusted sources to mitigate risk. Monitor NI's advisories for updates on patches or official mitigations.