NI LabVIEW Memory Corruption Vulnerability in LVLIB File Parsing Allowing Code Execution

A memory corruption vulnerability has been identified in NI LabVIEW versions 2026 Q1 (26.1.0) and prior. This vulnerability arises from an out-of-bounds write when the application loads a corrupted LVLIB file. Exploitation of this issue could lead to information disclosure or arbitrary code execution. To successfully exploit this vulnerability, an attacker must convince a user to open a specially crafted .lvlib file.

Impact

Exploitation of this vulnerability could result in memory corruption, allowing for information disclosure or arbitrary code execution.

Remediation

Users are advised to upgrade to LabVIEW 2026 Q1 Patch 1 or later. Instructions for downloading the patch are available on the NI website. For LabVIEW 2025, 2024, 2023, and 2022, specific upgrade guidance is also provided on the NI website.