CVE-2026-32861: 
LabVIEW vulnerability analysis and mitigation

CVE-2026-32861 is a memory corruption vulnerability in NI LabVIEW caused by an out-of-bounds write when parsing corrupted LVCLASS files. Successful exploitation requires user interaction — specifically, a user must open a specially crafted .lvclass file or visit a malicious page hosting such a file. The vulnerability affects NI LabVIEW 2026 Q1 (26.1.0) and all prior versions, including versions through 2022 and specific 2023–2025 quarterly releases. It was published on April 7, 2026, with a patch available from NI. The vulnerability carries a CVSS v4.0 base score of 8.5 (High) and a CVSS v3.1 base score of 7.8 (High) (GitHub Advisory, NI Advisory).

The root cause is an out-of-bounds write (CWE-787) in NI LabVIEW's LVCLASS file parser, resulting from insufficient validation of user-supplied data during file loading. When a specially crafted or corrupted .lvclass file is opened, the parser writes data beyond the bounds of an allocated buffer, triggering a memory corruption condition. The attack vector is local (the file must be opened by the user), requires no privileges, and has low attack complexity once the malicious file is delivered. A Zero Day Initiative advisory (ZDI-26-291) describes the flaw at a high level but contains no exploit code or reproduction steps (ZDI Advisory, GitHub Advisory).

Successful exploitation can result in arbitrary code execution in the context of the current LabVIEW process, as well as information disclosure. The vulnerability has high confidentiality, integrity, and availability impact on the vulnerable system, meaning an attacker could read sensitive data, modify system state, or crash the application. Because LabVIEW is widely used in industrial, scientific, and engineering environments — including ICS/OT contexts — exploitation could have significant downstream consequences depending on the deployment environment (NI Advisory, GitHub Advisory).

No confirmed public exploit or proof-of-concept code is available for CVE-2026-32861. The ZDI advisory (ZDI-26-291) is informational only and does not contain exploit methodology or payloads. There is no evidence of in-the-wild exploitation, no threat actor attribution, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.015–0.022%, placing it in a low percentile for near-term exploitation likelihood (ZDI Advisory, GitHub Advisory).

1. Craft a malicious LVCLASS file: Create a specially crafted .lvclass file containing malformed or oversized data in fields parsed by LabVIEW's class file parser, designed to trigger an out-of-bounds write when loaded.
2. Deliver the file to the target: Use social engineering techniques (e.g., phishing email with attachment, malicious download link, or a web page that auto-downloads the file) to get a LabVIEW user to receive the crafted file.
3. Induce the user to open the file: Convince the target to open the .lvclass file in NI LabVIEW, or host it on a malicious web page that triggers the file open action.
4. Trigger memory corruption: When LabVIEW parses the malformed file, the out-of-bounds write corrupts heap or stack memory in the LabVIEW process.
5. Achieve code execution: Leverage the memory corruption to redirect execution flow, potentially executing attacker-controlled shellcode or commands in the context of the LabVIEW process (ZDI Advisory, GitHub Advisory).

• File System: Unexpected or unsolicited .lvclass files received via email, downloads, or shared drives; .lvclass files with anomalous file sizes or malformed internal structure.
• Process: LabVIEW process (LabVIEW.exe) crashing unexpectedly or spawning unusual child processes (e.g., cmd.exe, powershell.exe, network utilities) after opening a .lvclass file.
• Logs: Application crash logs or Windows Event Log entries (Event ID 1000/1001) referencing LabVIEW.exe with access violation or out-of-bounds memory errors; Dr. Watson or WER (Windows Error Reporting) dumps generated by LabVIEW.
• Network: Unexpected outbound network connections from the LabVIEW process to unknown external IP addresses following file open events.

NI has released patches addressing this vulnerability. Users should upgrade to the following fixed versions or later: LabVIEW 2023 Q3 Patch 9 (23.3.9+), LabVIEW 2024 Q3 Patch 6 (24.3.6+), LabVIEW 2025 Q3 Patch 4 (25.3.4+), or LabVIEW 2026 Q1 Patch 1 (26.1.1+); all versions prior to 2023 (≤22.x) should be upgraded to a supported and patched release. As a workaround until patching is complete, users should avoid opening .lvclass files from untrusted or unknown sources and refrain from visiting potentially malicious web pages while LabVIEW is running (NI Advisory).

The vulnerability received routine coverage in ICS/OT security circles, with mention in a weekly public ICS disclosure review blog and CISA's vulnerability bulletin for the week of April 6, 2026. Social media activity was limited to automated CVE notification accounts on Bluesky and Mastodon. No notable independent researcher commentary or significant media coverage was identified beyond standard vulnerability aggregation (CISA Bulletin).