NI LabVIEW Use-After-Free Vulnerability in Sentry Component Allowing Information Disclosure or Arbitrary Code Execution

A use-after-free vulnerability has been identified in the Sentry component of NI LabVIEW, specifically in the function 'sentry_span_set_data()'. This vulnerability arises when the application parses a corrupted Virtual Instrument (VI) file. Successful exploitation could lead to information disclosure or arbitrary code execution. The vulnerability affects NI LabVIEW versions through 2025 Q3 (25.3). To exploit this vulnerability, an attacker must convince a user to open a specially crafted VI file.

Impact

Exploitation of this vulnerability could result in information disclosure or arbitrary code execution.

Remediation

Users are advised to upgrade to NI LabVIEW 2025 Q3 Patch 3 or later. Instructions for downloading the updated version are available on the NI Software Downloads page.