The vulnerability stems from an out‑of‑bounds read inside the function sentry_transaction_context_set_operation() in NI LabVIEW, which can lead to memory corruption. The resulting information disclosure or arbitrary code execution can occur if a user opens a maliciously crafted VI file. The impact is severe because it enables a local or remote attacker to execute code with the privileges of the affected user.

NI LabVIEW is the vendor, with affected releases including 2026 Q1 (version 26.1.0) and all earlier LabVIEW editions up through the 2025 and 2024 releases. The issue applies to all standard builds of the product that include the vulnerable function.

The CVSS score of 8.5 classifies this as high risk, yet the EPSS score of less than 1% indicates a low probability of exploitation in the wild. The vulnerability is not currently listed in the CISA KEV catalog. Successful exploitation requires a user to open a specially crafted VI file, implying a user‑interaction vector, typically remote. However, because the outcome can be code execution, the potential damage is significant.