CVE-2026-64202: CWE-125 Out-of-bounds read in NI LabVIEW

This vulnerability (CWE-125: Out-of-bounds read) in NI LabVIEW allows an attacker to cause memory corruption by tricking a user into opening a malicious VI file. Successful exploitation can result in information disclosure or arbitrary code execution. The affected versions include NI LabVIEW 2026 Q3 (26.3.0) and earlier, specifically versions 23.1.0, 24.1.0, 25.1.0, and 26.1.0. The CVSS v3.1 score is 7.8, indicating high severity, with attack vector local, low attack complexity, no privileges required, user interaction required, and impacts confidentiality, integrity, and availability.

If exploited, this vulnerability can lead to disclosure of sensitive information or allow an attacker to execute arbitrary code on the affected system. This can compromise system integrity and availability. Exploitation requires local access and user interaction (opening a crafted VI file). There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid opening VI files from untrusted sources and apply standard security best practices to limit exposure.