A memory corruption vulnerability in NI LabVIEW can allow an attacker to read beyond array bounds when loading a specially crafted VI, potentially leading to information disclosure or arbitrary code execution. The weakness is a classic out-of-bounds read (CWE-125) that can compromise the confidentiality, integrity and availability of a system.

NI LabVIEW versions 2026 Q3 (26.3.0) and all earlier releases are affected. The vulnerability applies to the standard NI LabVIEW product.

The CVSS score of 8.5 classifies the flaw as high severity, and the EPSS score of < 1% indicates a low but non‑zero exploitation probability. The lack of a KEV listing does not diminish the risk of exploitation. Due to the local user interaction requirement, the attack vector is inferred as a social engineering or phishing scenario where a user must intentionally open a malicious VI file. Once executed, the exploit could allow full code execution under the context of the current user.