Description
There is an integer conversion vulnerability resulting in an out-of-bounds read when loading images recently discovered in NI LabVIEW.  This may result in information disclosure or arbitrary code execution.  Successful exploitation requires an attacker to get a user to open a specially crafted VI file.  This vulnerability affects NI LabVIEW 2026 Q3 and prior versions.
Published: 2026-08-25
Score: 6.9 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

NI LabVIEW 2026 Q3 and earlier versions contain an integer conversion flaw that causes an out‑of‑bounds read when loading specially crafted images. The vulnerability can lead to disclosure of sensitive data or, in worst‑case scenarios, arbitrary code execution within the user’s session. The flaw is tied to CWE‑195, an improper conversion or truncation of an integral type.

Affected Systems

The affected product is National Instruments LabVIEW, specifically version 2026 Q3 and all earlier releases. Users running LabVIEW on any platform supported by NI should verify their current LabVIEW build against the version list in the vendor advisory for potential impact.

Risk and Exploitability

The CVSS score of 6.9 indicates medium severity. Exploitation requires a user to open a malicious VI file, implying a user interaction attack vector. Exploit probability data from EPSS is not available, and the vulnerability is not yet listed in the CISA KEV catalog. Given the potential for code execution and lack of mitigation in older releases, the risk remains significant for systems that continue to operate affected versions or accept unknown VI files.

Generated by OpenCVE AI on August 25, 2026 at 17:29 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest vendor patch released by NI for LabVIEW 2026 Q3 or later versions.
  • Immediately remove or quarantine any LabVIEW installations that remain at a version earlier than 2026 Q3 and cannot be patched.
  • Enforce a policy that users avoid opening VI files from untrusted or unknown sources, and apply automated scanning tools to inspect VI files prior to execution.

Generated by OpenCVE AI on August 25, 2026 at 17:29 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 25 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Description There is an integer conversion vulnerability resulting in an out-of-bounds read when loading images recently discovered in NI LabVIEW.  This may result in information disclosure or arbitrary code execution.  Successful exploitation requires an attacker to get a user to open a specially crafted VI file.  This vulnerability affects NI LabVIEW 2026 Q3 and prior versions.
Title Integer Conversion Vulnerability Resulting in an Out of Bounds Read in NI LabVIEW
First Time appeared Ni
Ni labview
Weaknesses CWE-195
CPEs cpe:2.3:a:ni:labview:*:*:*:*:*:*:*:*
Vendors & Products Ni
Ni labview
References
Metrics cvssV3_1

{'score': 6.6, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Ni Labview
cve-icon MITRE

Status: PUBLISHED

Assigner: NI

Published:

Updated: 2026-08-25T16:09:03.396Z

Reserved: 2026-07-30T22:06:03.338Z

Link: CVE-2026-18444

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-25T17:17:05.803

Modified: 2026-08-25T17:17:05.803

Link: CVE-2026-18444

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-25T17:30:07Z

Weaknesses
  • CWE-195

    Signed to Unsigned Conversion Error