NI LabVIEW Out-of-Bounds Write Vulnerability Allowing Information Disclosure or Arbitrary Code Execution

A vulnerability allowing out-of-bounds write has been identified in NI LabVIEW versions 2025 Q1 and prior. This issue arises from improper bounds checking when the application reads CPU information from cache. Successful exploitation of this vulnerability could lead to information disclosure or arbitrary code execution. However, it requires an attacker to persuade a user to open a specially crafted virtual instrument (VI).

Impact

Exploitation of this vulnerability could result in unauthorized information disclosure or arbitrary code execution within the context of the user.

Remediation

Users are advised to upgrade to NI LabVIEW 2025 Q1 Patch 2 or later. Instructions for downloading this update are available on the NI website. For LabVIEW 2024, 2023, and 2022, similar upgrade guidance is provided. Users with LabVIEW 2021 and prior should note that these versions are not in mainstream support.