NI LabVIEW Out-of-Bounds Read Vulnerability in VI File Parsing Allowing Information Disclosure or Arbitrary Code Execution

An out-of-bounds read vulnerability has been identified in NI LabVIEW versions 2025 Q3 (25.3) and prior. The issue arises in the function LVResFile::RGetMemFileHandle() when the software parses a corrupted VI file. This vulnerability could lead to information disclosure or arbitrary code execution. Exploitation requires an attacker to persuade a user to open a specially crafted VI file.

Impact

Exploitation of this vulnerability could result in unauthorized information disclosure or arbitrary code execution on the affected system.

Remediation

Users are advised to upgrade to NI LabVIEW 2025 Q3 Patch 3 or later. Instructions for downloading the update are available on the NI Software Downloads page.