NI LabVIEW Out-of-Bounds Write Vulnerability in VI File Parsing Allowing Information Disclosure or Arbitrary Code Execution

An out-of-bounds write vulnerability has been identified in NI LabVIEW versions 2025 Q3 (25.3) and prior. The issue arises in the function mgocre_SH_25_3!RevBL() when it processes a corrupted VI file. Exploitation of this vulnerability could lead to information disclosure or arbitrary code execution. However, successful exploitation requires an attacker to persuade a user to open a specially crafted VI file.

Impact

Exploitation of this vulnerability could result in unauthorized information disclosure or arbitrary code execution on the affected system.

Remediation

Users are advised to upgrade to NI LabVIEW 2025 Q3 Patch 3 or later. Instructions for downloading the update are available on the NI Software Downloads page.