A memory corruption flaw arises from an out‑of‑bounds read in the function mgcore_SH_25_3!aligned_free() used by NI LabVIEW. This weakness allows a specially constructed VI file to be read beyond intended bounds, potentially leaking sensitive memory contents or enabling arbitrary code execution. The root cause corresponds to a classic CWE‑125 vulnerability.

All NI LabVIEW releases through 2026 Q1 (26.1.0) and all prior versions are affected, including 2025 Q1, 2024 Q3, 2023 Q3, 2023 Q1 and earlier builds. Any installation that has not been updated to a post‑Q1 release remains vulnerable.

The CVSS score of 8.5 marks this as a high‑severity issue, but the EPSS score is below 1 %, indicating a low likelihood of widespread exploitation at this time. The flaw is not listed in CISA’s KEV catalog. Exploitation requires the attacker to supply a malicious VI file and convince a user to open it, pointing to a local or social‑engineering attack surface. Until a newer LabVIEW patch is applied, environments that may import untrusted VI files remain at significant risk of data compromise or remote code execution.