CVE-2024-4079: 
LabVIEW vulnerability analysis and mitigation

An out-of-bounds read vulnerability (CVE-2024-4079) was discovered in LabVIEW affecting versions 2024 Q1 and prior. The vulnerability stems from a missing bounds check in the software that could lead to information disclosure or arbitrary code execution. The issue was discovered by Michael Heinzl working with CISA and requires an attacker to provide a user with a specially crafted VI file for successful exploitation (NI Advisory, CISA Advisory).

The vulnerability is classified as CWE-125 (Out-of-bounds Read) with a CVSS v3.1 base score of 7.8 (HIGH), and vector string AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The CVSS v4.0 score is 8.4. The vulnerability requires local access and user interaction, but no privileges, to exploit (CISA Advisory).

Successful exploitation of this vulnerability could allow an attacker to disclose sensitive information or execute arbitrary code on affected installations of LabVIEW. The vulnerability affects critical infrastructure sectors including Critical Manufacturing, Defense Industrial Base, Information Technology, and Transportation Systems (CISA Advisory).

The vulnerability requires local access and user interaction for successful exploitation. An attacker must provide a user with a specially crafted VI file. No known public exploits specifically targeting this vulnerability have been reported (CISA Advisory).

National Instruments has released patches for affected versions. Users should upgrade to LabVIEW 2024 Q3 or later for 2024 Q1 versions, install LabVIEW 2023 Q3 Patch 3 or later for 2023 versions, LabVIEW 2022 Q3 Patch 1 or later for 2022 versions, and LabVIEW 2021 SP1 f2 or later for 2021 versions. LabVIEW 2020 and prior versions are no longer in Mainstream Support (NI Advisory).