NI LabVIEW Stack-Based Buffer Overflow Vulnerability Allowing Arbitrary Code Execution

A stack-based buffer overflow vulnerability has been identified in NI LabVIEW versions 2025 Q3 (25.3) and prior. The issue arises in the function LVResFile::FindRsrcListEntry() while parsing a corrupted VI file. Exploitation of this vulnerability could lead to information disclosure or arbitrary code execution. However, successful exploitation requires an attacker to persuade a user to open a specially crafted VI file.

Impact

Exploitation of this vulnerability could result in arbitrary code execution or information disclosure.

Remediation

Users are advised to upgrade to NI LabVIEW 2025 Q3 Patch 3 or later. Instructions for downloading the update are available on the NI website.