NI LabVIEW Out-of-Bounds Read Vulnerability in ExecPostedProcRecPost Function Allowing Information Disclosure or Arbitrary Code Execution

An out-of-bounds read vulnerability has been identified in NI LabVIEW versions through 2025 Q3 (25.3). The issue arises in the lvre!ExecPostedProcRecPost() function while parsing corrupted VI files. This vulnerability could lead to information disclosure or arbitrary code execution. Exploitation requires an attacker to persuade a user to open a specially crafted VI file.

Impact

Exploitation of this vulnerability could result in unauthorized information disclosure or arbitrary code execution on the affected system.

Remediation

Users are advised to upgrade to NI LabVIEW 2025 Q3 Patch 3 or later. Instructions for downloading the update are available on the NI website.