Full Report
[Control Systems] National Instruments security advisory (AV26-856)
Analysis Summary
# Vulnerability: Multiple Memory Corruption Flaws in NI LabVIEW
## CVE Details
*Note: The provided advisory summary mentions multiple vulnerabilities; specific CVE IDs were not explicitly detailed in the text snippet, but the flaws are categorized as follows based on vendor descriptions:*
- **CVE ID:** [Pending/Multiple - Refer to NI-2026-AV]
- **CVSS Score:** High/Critical (Typical for remote code execution via memory corruption)
- **CWE:** CWE-190 (Integer Overflow), CWE-125 (Out-of-bounds Read), CWE-787 (Out-of-bounds Write)
## Affected Systems
- **Products:** National Instruments (NI) LabVIEW
- **Versions:**
- Versions prior to 23.0.0
- Versions prior to 23.3.10
- Versions prior to 24.3.7
- Versions prior to 25.3.5
- Versions prior to 26.3.1
- **Configurations:** Systems processing LabVIEW project files or external data inputs that trigger memory management routines.
## Vulnerability Description
National Instruments LabVIEW is affected by multiple memory corruption vulnerabilities:
1. **Integer Conversion / Out-of-Bounds Read:** A flaw in how LabVIEW handles integer conversions can lead to an out-of-bounds read, potentially leaking sensitive memory information.
2. **Integer Overflow / Out-of-Bounds Write:** An integer overflow during memory allocation or buffer management allows for an out-of-bounds write. This can lead to arbitrary code execution or a denial-of-service (DoS) condition.
3. **General Memory Corruption:** Related flaws in LabVIEW's handling of specific data structures that could be exploited via maliciously crafted files.
## Exploitation
- **Status:** Not currently reported as exploited in the wild; PoC status not publicly confirmed.
- **Complexity:** Medium (Requires a user to open a specially crafted file).
- **Attack Vector:** Local/Network (Typically delivered via social engineering or file sharing where a user opens a malicious LabVIEW file).
## Impact
- **Confidentiality:** High (Potential memory leakage).
- **Integrity:** High (Potential for arbitrary code execution).
- **Availability:** High (System crash or application termination).
## Remediation
### Patches
National Instruments recommends updating to the following versions (or newer):
- LabVIEW 23.0.0+
- LabVIEW 23.3.10+
- LabVIEW 24.3.7+
- LabVIEW 25.3.5+
- LabVIEW 26.3.1+
### Workarounds
- Do not open LabVIEW files (.vi, .lvproj, etc.) from untrusted or unknown sources.
- Implement Principle of Least Privilege (PoLP) for users operating LabVIEW environments to limit the impact of potential code execution.
## Detection
- **Indicators of Compromise:** Unexpected application crashes when opening specific project files; unusual outbound network traffic from LabVIEW processes.
- **Detection methods and tools:** Use Endpoint Detection and Response (EDR) tools to monitor for suspicious child processes spawned by `LabVIEW.exe`.
## References
- NI Security Advisory (Memory Corruption): hxxps[://]www[.]ni[.]com/en/support/security/available-critical-and-security-updates-for-ni-software/2026/memory-corruption-vulnerabilities-ni-labview[.]html
- NI Security Advisory (Out-of-bounds Read): hxxps[://]www[.]ni[.]com/en/support/security/available-critical-and-security-updates-for-ni-software/2026/integer-conversion-vulnerability-resulting-in-an-out-of-bounds-read-in-ni-labview[.]html
- NI Security Advisory (Out-of-bounds Write): hxxps[://]www[.]ni[.]com/en/support/security/available-critical-and-security-updates-for-ni-software/2026/integer-overflow-vulnerability-resulting-in-an-out-of-bounds-write-in-ni-labview[.]html
- Government of Canada Cyber Centre (AV26-856): hxxps[://]www[.]cyber[.]gc[.]ca/en/alerts-advisories/control-systems-national-instruments-security-advisory-av26-856