CVE-2025-64468: 
LabVIEW vulnerability analysis and mitigation

CVE-2025-64468 is a use-after-free vulnerability in the sentry!sentry_span_set_data() function of NI LabVIEW, triggered when parsing a corrupted VI (Virtual Instrument) file. It affects NI LabVIEW 2025 Q3 (25.3) and all prior versions, spanning releases from 2022 Q1 through 2025 Q3 patch 2. The vulnerability was disclosed on December 18, 2025, by National Instruments (NI) as the CNA. It carries a CVSS v3.1 base score of 7.8 (High) and a CVSS v4.0 base score of 8.5 (High) (NI Advisory, Red Hat CVE).

The vulnerability is classified as CWE-416 (Use After Free), occurring in the sentry!sentry_span_set_data() function during the parsing of a specially crafted or corrupted VI file. When LabVIEW processes such a malformed file, memory that has already been freed is subsequently accessed, creating conditions for memory corruption. The attack vector is local, requiring no privileges, but does require user interaction — specifically, a user must be socially engineered into opening a malicious .vi file. No public proof-of-concept code has been identified at this time (NI Advisory, Red Hat CVE).

Successful exploitation can result in information disclosure or arbitrary code execution with the privileges of the user running LabVIEW. Given that LabVIEW is widely used in industrial control, test and measurement, and scientific research environments, a compromised workstation could expose sensitive operational data or provide an attacker with a foothold for lateral movement within engineering or OT networks. The full triad of confidentiality, integrity, and availability is rated HIGH in both CVSS v3.1 and v4.0 assessments (NI Advisory, CISA ICS Advisory).

There is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation as of the time of disclosure (Red Hat CVE). The EPSS score is approximately 0.015% (0.000150), indicating a very low current probability of exploitation in the wild. No threat actor attribution has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. CISA has, however, published an ICS advisory (ICSA-25-352-03) covering this and related LabVIEW memory corruption vulnerabilities (CISA ICS Advisory).

1. Craft a malicious VI file: An attacker creates a specially crafted or corrupted LabVIEW VI (.vi) file designed to trigger the use-after-free condition in sentry!sentry_span_set_data() during file parsing.
2. Social engineering delivery: The attacker delivers the malicious VI file to a target user via email attachment, file-sharing platform, or a compromised internal repository, leveraging the trust that LabVIEW engineers typically place in VI files shared among colleagues.
3. User opens the file: The victim opens the malicious VI file in a vulnerable version of NI LabVIEW (2025 Q3 or earlier), triggering the parsing routine.
4. Use-after-free triggered: The corrupted file structure causes sentry_span_set_data() to access previously freed memory, resulting in memory corruption.
5. Code execution or information disclosure: Depending on heap layout and attacker control over freed memory contents, the attacker may achieve arbitrary code execution with the user's privileges or leak sensitive memory contents (NI Advisory, CISA ICS Advisory).

• File System: Unexpected or unsolicited .vi files received via email or file shares, particularly from external or unknown sources; presence of VI files with anomalous file sizes or corrupted internal structures.
• Process: LabVIEW process (LabVIEW.exe) spawning unexpected child processes (e.g., cmd.exe, powershell.exe, network utilities) following the opening of a VI file; application crashes or abnormal termination of LabVIEW shortly after opening a specific file.
• Logs: Windows Event Logs showing application crashes (Event ID 1000/1001) referencing LabVIEW.exe or associated DLLs; crash dump files (.dmp) generated in the LabVIEW installation or user temp directory.
• Network: Unexpected outbound network connections from the LabVIEW process to external IP addresses following file open events, which may indicate post-exploitation callback activity.

NI has released patches addressing this vulnerability; users should update to a fixed version beyond LabVIEW 2025 Q3 (25.3) — specifically, versions released after the patch date of December 2025 (NI Advisory). As an interim workaround, users should avoid opening VI files from untrusted or unverified sources, and organizations should implement strict file validation and scanning procedures for VI files entering the environment. CISA also recommends minimizing network exposure for LabVIEW workstations and applying defense-in-depth principles for ICS/OT environments (CISA ICS Advisory).

CISA published ICS Advisory ICSA-25-352-03 covering this and related NI LabVIEW memory corruption vulnerabilities, signaling its relevance to industrial control system operators (CISA ICS Advisory). Security aggregator Infinit Security published a brief technical summary of the vulnerability (Infinit Security). Overall community reaction has been measured, consistent with the absence of public exploit code and active exploitation.