The vulnerability arises from an out‑of‑bounds write that corrupts memory during the loading of a .lvclass file. An attacker can supply a specially crafted file to trigger the corruption, potentially allowing the disclosure of sensitive information or the execution of arbitrary code on the affected system. The defect is classified as CWE‑787, an out‑of‑bounds write.

Affected products are NI LabVIEW from National Instruments, specifically any release through 2026 Q1 (version 26.1.0) and earlier. Users running these versions should review the vendor’s advisory for available patches. No specific mitigations are listed for versions beyond the first quarter of 2026.

The CVSS score of 8.5 indicates high severity, but the EPSS score of less than 1 % shows exploitation probability is low and the vulnerability has not been reported as a known exploited weakness (not in KEV). Exploitation typically requires the victim to open a malicious .lvclass file, so the attack vector is user‑initiated local or remote file delivery. If an attacker can persuade an end‑user or program to load the file, arbitrary code execution could occur with the privileges of the user.