CVE-2025-64464: 
LabVIEW vulnerability analysis and mitigation

CVE-2025-64464 is an out-of-bounds read vulnerability in NI LabVIEW within the lvre!VisaWriteFromFile() function, triggered when parsing a specially crafted (corrupted) VI file. It affects NI LabVIEW 2025 Q3 (25.3) and all prior versions, including releases from the 2022, 2023, 2024, and 2025 quarterly release trains. The vulnerability was published on December 18, 2025, with an initial analysis completed by December 24, 2025. It carries a CVSS v3.1 base score of 7.8 (High) and a CVSS v4.0 base score of 8.5 (High), as assigned by National Instruments (NI Advisory, Feedly).

The root cause is an out-of-bounds read (CWE-125) in the lvre!VisaWriteFromFile() function within NI LabVIEW's VI file parser. When LabVIEW processes a malformed or corrupted .vi file, insufficient bounds checking allows the function to read memory beyond the intended buffer boundary. This memory corruption condition can lead to information disclosure (exposing sensitive memory contents) or, under the right conditions, arbitrary code execution. Exploitation requires user interaction — specifically, a victim must be socially engineered into opening a specially crafted VI file (NI Advisory, Feedly).

Successful exploitation can result in high-impact consequences across all three security dimensions: confidentiality (sensitive memory contents may be disclosed), integrity (arbitrary code execution could allow unauthorized modification of data or system state), and availability (the application or system may crash or become unstable). Because LabVIEW is widely used in industrial control, test and measurement, and scientific research environments, compromise of a LabVIEW workstation could have downstream effects on connected instrumentation or operational technology systems (NI Advisory, Feedly).

As of the time of reporting, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (Feedly). The EPSS score is approximately 0.015% (0.000150), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction (opening a malicious VI file), which limits the attack surface to targeted social engineering scenarios. A CISA ICS advisory (ICSA-25-352-03) was published in relation to this and related LabVIEW memory corruption vulnerabilities (CISA ICS Advisory).

1. Craft a malicious VI file: Create a specially crafted NI LabVIEW .vi file with a corrupted structure designed to trigger an out-of-bounds read in the lvre!VisaWriteFromFile() function during parsing.
2. Deliver the file to the target: Use social engineering techniques (e.g., phishing email, malicious download link, or shared network drive) to deliver the crafted .vi file to a user running a vulnerable version of NI LabVIEW (2025 Q3 or earlier).
3. Induce the victim to open the file: Convince the target user to open the malicious .vi file in LabVIEW, for example by disguising it as a legitimate instrument control or data acquisition program.
4. Trigger the vulnerability: Upon opening, LabVIEW's VI file parser invokes lvre!VisaWriteFromFile(), which reads beyond the intended buffer boundary due to insufficient bounds checking.
5. Achieve impact: Depending on memory layout and exploit refinement, the attacker may achieve information disclosure (reading sensitive memory) or, with further exploitation, arbitrary code execution in the context of the LabVIEW process (NI Advisory).

• File System: Unexpected or unsolicited .vi files received via email attachments, downloads, or shared drives; VI files with anomalous file sizes or corrupted internal structures.
• Process: LabVIEW process (LabVIEW.exe) crashing or generating unhandled exception errors when opening specific VI files; unexpected child processes spawned by the LabVIEW process.
• Logs: Application crash logs or Windows Event Logs (Event ID 1000/1001) referencing LabVIEW.exe or lvre.dll with access violation or out-of-bounds read errors; Dr. Watson or Windows Error Reporting dumps associated with LabVIEW.
• Network: Outbound network connections from the LabVIEW process to unexpected external IP addresses following the opening of a VI file (potential indicator of post-exploitation activity).

NI has released patches addressing this vulnerability; users should upgrade to a version of NI LabVIEW beyond 2025 Q3 (25.3) as detailed in the vendor advisory (NI Advisory). As interim mitigations, organizations should avoid opening VI files from untrusted or unverified sources, implement strict file validation processes, and educate users about the risks of opening files from unknown origins. Application whitelisting and network segmentation of LabVIEW workstations (particularly in ICS/OT environments) can further reduce exposure (CISA ICS Advisory).

CISA published ICS advisory ICSA-25-352-03 in relation to this and related NI LabVIEW memory corruption vulnerabilities, highlighting the relevance to industrial control system environments (CISA ICS Advisory). Security aggregators and vulnerability tracking platforms including Vulners, VulDB, and Tenable have indexed the vulnerability. No significant independent researcher commentary or notable social media discussion has been identified beyond standard vulnerability disclosure coverage.