CVE-2026-64204 - Vulnerability Details

- Out-of-Bounds Write Vulnerability in NI LabVIEW when loading VI

Description

There is a memory corruption vulnerability recently
discovered in NI LabVIEW that may result in information disclosure or arbitrary
code execution. Successful exploitation requires an attacker to get a
user to open a specially crafted VI. This vulnerability affects NI
LabVIEW 2026 Q3 (26.3.0) and prior versions.

Published: 2026-08-25

Score: 8.5 High

EPSS: n/a

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability is a memory corruption flaw caused by an out-of-bounds write in NI LabVIEW when a user loads a VI. According to the description, this flaw can lead to information disclosure or arbitrary code execution, which is consistent with the CWE-787 classification.

Affected Systems

NI LabVIEW 2026 Q3 (build 26.3.0) and all earlier releases are affected. The flaw is present in all known NI LabVIEW products that include the VI loader.

Risk and Exploitability

The CVSS score of 8.5 indicates a high severity level. There is no EPSS score available, so the precise exploitation likelihood is unknown, but the vulnerability is not listed in the CISA KEV catalog at this time. Exploitation requires a user to open a specially crafted VI, so the attack vector is local user interaction, possibly via phishing or social engineering.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

LabVIEW

unaffected

Version	Status	Constraints
`0`	affected	< 23.0.0
`23.1.0`	affected	< 23.3.10
`24.1.0`	affected	< 24.3.7
`25.1.0`	affected	< 25.3.5
`26.1.0`	affected	< 26.3.1

No data.

Vendor Product Confidence Versions

Labview

90%

Version	Status	Scheme	Platform
`[0,23.0.0)`	affected	semver	—
`[23.1.0,23.3.10)`	affected	semver	—
`[24.1.0,24.3.7)`	affected	semver	—
`[25.1.0,25.3.5)`	affected	semver	—
`[26.1.0,26.3.1)`	affected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the official LabVIEW security update released by NI that addresses the out‑of‑bounds write flaw.
Ensure all installations of LabVIEW are upgraded to a patched version that is newer than 2026 Q3 (26.3.0).
Restrict user access so that only trusted and validated VI files can be opened, and provide training to users about the risks of opening unknown VI files.

Generated by OpenCVE AI on August 25, 2026 at 20:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Local

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/2026/memory-corruption-vulnerabilities-ni-labview.html

History

Tue, 25 Aug 2026 18:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Tue, 25 Aug 2026 17:00:00 +0000

Type	Values Removed	Values Added
Description		There is a memory corruption vulnerability recently discovered in NI LabVIEW that may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted VI. This vulnerability affects NI LabVIEW 2026 Q3 (26.3.0) and prior versions.
Title		Out-of-Bounds Write Vulnerability in NI LabVIEW when loading VI
First Time appeared		Ni Ni labview
Weaknesses		CWE-787
CPEs		cpe:2.3:a:ni:labview::::::::
Vendors & Products		Ni Ni labview
References		https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/2026/memory-corruption-vulnerabilities-ni-labview.html
Metrics		cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}` cvssV4_0 `{'score': 8.5, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}`

Subscriptions

Ni Labview

MITRE

Status: PUBLISHED

Assigner: NI

Published: 2026-08-25T16:52:41.413Z

Updated: 2026-08-25T17:43:23.755Z

Reserved: 2026-07-19T15:12:06.826Z

Link: CVE-2026-64204

Vulnrichment

Updated: 2026-08-25T17:38:58.500Z

NVD

Status : Received

Published: 2026-08-25T17:17:59.727

Modified: 2026-08-25T18:17:59.653

Link: CVE-2026-64204

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-08-25T21:00:04Z

Weaknesses

CWE-787
Out-of-bounds Write

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

Exploitation none

Automatable no

Technical Impact total

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object