NI LabVIEW Out-of-Bounds Write Vulnerability Allowing Information Disclosure or Arbitrary Code Execution

A vulnerability allowing out-of-bounds write has been identified in NI LabVIEW versions 2025 Q1 and prior. This issue arises from improper bounds checking in the InitCPUInformation() function, potentially leading to information disclosure or arbitrary code execution. Exploitation of this vulnerability requires an attacker to persuade a user to open a specially crafted virtual instrument (VI).

Impact

Exploitation of this vulnerability could result in unauthorized information disclosure or arbitrary code execution within the context of the user.

Remediation

Users are advised to upgrade to NI LabVIEW 2025 Q1 Patch 2 or later. Instructions for downloading the update are available on the NI website.