CVE-2026-64203: CWE-125 Out-of-bounds read in NI LabVIEW

This vulnerability in NI LabVIEW is caused by an out-of-bounds read (CWE-125) that may result in memory corruption. Successful exploitation requires user interaction by opening a malicious VI file, potentially leading to information disclosure or arbitrary code execution. The CVSS v3.1 base score is 7.8, indicating high severity, with attack vector local, low attack complexity, no privileges required, user interaction required, and impacts to confidentiality, integrity, and availability. Affected versions explicitly include 23.1.0, 24.1.0, 25.1.0, and 26.1.0. No vendor advisory or patch information is currently available to confirm remediation status.

The vulnerability allows an attacker to cause memory corruption that can lead to information disclosure or arbitrary code execution on affected systems. Exploitation requires local access and user interaction, specifically opening a crafted VI file. The impact affects confidentiality, integrity, and availability of the system running NI LabVIEW.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid opening VI files from untrusted sources to mitigate risk.