CVE-2026-64204: 
LabVIEW vulnerability analysis and mitigation

CVE-2026-64204 is a memory corruption vulnerability in NI LabVIEW that may result in information disclosure or arbitrary code execution. It was published on August 25, 2026, and affects NI LabVIEW versions up to and including 2026 Q3 (26.3.0), spanning multiple release branches: all versions prior to 23.0.0, versions 23.1.0 through 23.3.9, 24.1.0 through 24.3.6, 25.1.0 through 25.3.4, and 26.1.0 through 26.3.0. Exploitation requires a user to open a specially crafted Virtual Instrument (VI) file. The vulnerability carries a CVSS v3.1 base score of 7.8 (High) and a CVSS v4.0 base score of 8.5 (High) (GitHub Advisory, NI Advisory).

The vulnerability is classified as CWE-787 (Out-of-bounds Write), meaning the software writes data past the end or before the beginning of an intended buffer during the parsing or processing of VI files (GitHub Advisory). The attack vector is local, requiring no privileges, but does require passive user interaction — specifically, a user must open a maliciously crafted VI file delivered by the attacker. Attack complexity is low and no special deployment conditions are required, making the exploitation straightforward once the file is opened. No public proof-of-concept code or detailed technical write-ups have been identified at this time (GitHub Advisory).

Successful exploitation can result in high-impact consequences across confidentiality, integrity, and availability of the affected LabVIEW process. An attacker can achieve arbitrary code execution with the privileges of the LabVIEW process, disclose sensitive information from memory, or crash the application entirely. Given that LabVIEW is widely used in industrial, scientific, and engineering environments — including critical infrastructure — exploitation could have significant downstream consequences depending on the deployment context (NI Advisory, GitHub Advisory).

As of the disclosure date, there is no evidence of active in-the-wild exploitation and no public proof-of-concept exploit has been identified (GitHub Advisory). The EPSS score is approximately 0.128% (3rd percentile), indicating a low near-term probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is non-automatable due to the required user interaction of opening a crafted VI file, and no threat actor attribution has been reported.

1. Craft a malicious VI file: The attacker creates a specially crafted LabVIEW Virtual Instrument (.vi) file designed to trigger an out-of-bounds write condition during parsing or processing by the LabVIEW runtime.
2. Deliver the malicious file: The attacker distributes the crafted VI file to the target user via email attachment, file sharing platform, USB drive, or a compromised internal repository — leveraging social engineering to make the file appear legitimate.
3. Induce the user to open the file: The attacker convinces the target (e.g., an engineer or researcher) to open the VI file in NI LabVIEW on a vulnerable version (≤26.3.0).
4. Trigger memory corruption: Upon opening, LabVIEW processes the malformed VI file, causing an out-of-bounds write in memory, which corrupts adjacent memory regions.
5. Achieve code execution or information disclosure: Depending on the specific memory layout and exploit precision, the attacker may redirect execution flow to attacker-controlled code running with the privileges of the LabVIEW process, or extract sensitive data from memory (GitHub Advisory, NI Advisory).

• File System: Unexpected or unsolicited .vi files received via email, file shares, or removable media; VI files with unusual metadata, unexpected file sizes, or originating from unknown sources.
• Process: Unusual child processes spawned by the LabVIEW executable (e.g., cmd.exe, powershell.exe, bash, curl, or network utilities); LabVIEW process crashing unexpectedly or exhibiting abnormal memory usage.
• Logs: Application crash logs or Windows Event Logs (Event ID 1000/1001) referencing LabVIEW process faults; Dr. Watson or Windows Error Reporting entries tied to LabVIEW after opening a VI file.
• Network: Unexpected outbound network connections from the LabVIEW process to external IP addresses following the opening of a VI file, which may indicate a reverse shell or data exfiltration attempt.

NI has released patched versions addressing this vulnerability: users should upgrade to LabVIEW 23.3.10 or later (for the 2023 branch), 24.3.7 or later (for the 2024 branch), 25.3.5 or later (for the 2025 branch), or 26.3.1 or later (for the 2026 branch) (NI Advisory). As an interim workaround, organizations should restrict users from opening VI files from untrusted or unknown sources, implement file-type filtering on email gateways and file shares, and educate users about the risks of opening unsolicited VI files. Applying the principle of least privilege to LabVIEW processes can also limit the impact of a successful exploit.