CVE-2025-64467: 
LabVIEW vulnerability analysis and mitigation

CVE-2025-64467 is an out-of-bounds read vulnerability in NI LabVIEW's LVResFile::FindRsrcListEntry() function, triggered when parsing a specially crafted or corrupted VI (Virtual Instrument) file. Successful exploitation can result in information disclosure or arbitrary code execution. The vulnerability affects NI LabVIEW 2025 Q3 (25.3) and all prior versions, spanning releases from 2022 Q1 through 2025 Q3 patch 2. It was disclosed on December 18, 2025, by National Instruments (NI), with initial NVD analysis completed December 24, 2025. The CNA-assigned CVSS v3.1 base score is 7.8 (High) and CVSS v4.0 base score is 8.5 (High) (NI Advisory, Red Hat CVE).

The vulnerability is classified as CWE-125 (Out-of-bounds Read), mapped to CAPEC-540 (Overread Buffers). The flaw resides in the LVResFile::FindRsrcListEntry() function, which fails to properly validate bounds when parsing resource list entries in a corrupted or maliciously crafted VI file. An attacker must convince a user to open a specially crafted .vi file — no prior system privileges are required, but user interaction is necessary. The out-of-bounds read can expose memory contents (information disclosure) or, depending on memory layout, may be leveraged to achieve arbitrary code execution (NI Advisory, Red Hat CVE).

Successful exploitation can result in high-impact confidentiality, integrity, and availability consequences on the affected system. An attacker who tricks a user into opening a malicious VI file could disclose sensitive memory contents or execute arbitrary code in the context of the LabVIEW process, potentially leading to full system compromise. Given LabVIEW's common deployment in industrial, scientific, and engineering environments, exploitation could affect critical measurement and automation infrastructure (NI Advisory, CISA ICS Advisory).

As of the disclosure date, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (Feedly). The EPSS score is approximately 0.015% (0.000150), indicating a very low probability of exploitation in the near term. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, though CISA published an ICS advisory (ICSA-25-352-03) covering this and related LabVIEW memory corruption issues (CISA ICS Advisory). Exploitation requires social engineering to deliver a crafted VI file to a target user.

1. Craft a malicious VI file: Create a specially crafted NI LabVIEW VI file with a corrupted resource list structure that triggers an out-of-bounds read in LVResFile::FindRsrcListEntry() during file parsing.
2. Deliver the file to the target: Use social engineering techniques (e.g., phishing email, malicious download link, or shared network drive) to deliver the crafted .vi file to a user running a vulnerable version of NI LabVIEW (2025 Q3 or earlier).
3. Induce the user to open the file: Convince the target to open the file in LabVIEW, which triggers the vulnerable parsing routine.
4. Trigger out-of-bounds read: The malformed resource list entry causes LVResFile::FindRsrcListEntry() to read beyond allocated memory boundaries, potentially leaking sensitive memory contents or corrupting memory state.
5. Achieve objective: Depending on memory layout and exploitation sophistication, the attacker may obtain sensitive information from process memory or achieve arbitrary code execution in the context of the LabVIEW process (NI Advisory).

• File System: Unexpected or unsolicited .vi files received via email, downloads, or shared drives from unknown or untrusted sources; VI files with anomalous file sizes or corrupted internal structure.
• Process: LabVIEW process (LabVIEW.exe) crashing or generating access violation errors when opening a VI file; unusual child processes spawned by the LabVIEW process (e.g., cmd.exe, powershell.exe, network utilities).
• Logs: Application crash logs or Windows Event Logs (Event ID 1000/1001) referencing LabVIEW.exe with faulting module related to resource file parsing; Dr. Watson or WER (Windows Error Reporting) dumps from LabVIEW.
• Network: Unexpected outbound network connections from the LabVIEW process to external IP addresses following the opening of a VI file.

NI has released patches addressing this vulnerability; users should update to a fixed version beyond the affected range (all versions through 2025 Q3/25.3). The vendor advisory provides specific patched builds for the 2022, 2023, 2024, and 2025 release lines (NI Advisory). As interim mitigations: implement strict file validation and screening for VI files from untrusted sources, educate users not to open VI files from unknown origins, and consider application whitelisting to restrict unauthorized VI file execution. Organizations should consult the CISA ICS advisory (ICSA-25-352-03) for additional guidance relevant to industrial environments (CISA ICS Advisory).

CISA published ICS Advisory ICSA-25-352-03 covering this and related NI LabVIEW memory corruption vulnerabilities, highlighting the relevance to industrial control system environments (CISA ICS Advisory). Red Hat also tracked the CVE in their security database (Red Hat CVE). No significant independent researcher commentary or notable social media discussion has been observed beyond standard vulnerability aggregator coverage.