Loading story…
Several high-severity vulnerabilities have been identified in NI LabVIEW, affecting version 2025 Q3 (25.3) and earlier. These vulnerabilities include out-of-bounds reads and writes, stack-based buffer overflows, and use-after-free conditions in various LabVIEW components such as LVResFile::FindRsrcListEntry(), mgocre_SH_25_3!RevBL(), LVResource::DetachResource(), and sentry!sentry_span_set_data(). Exploitation of these flaws requires a user to open a specially crafted VI file, potentially leading to information disclosure or arbitrary code execution. The vulnerabilities are not remotely exploitable but pose significant risk if a malicious file is opened on a vulnerable system.
CISA has issued an advisory confirming that these vulnerabilities (CVE-2025-64461 through CVE-2025-64469) impact critical infrastructure sectors, including manufacturing, defense, IT, and transportation. The advisory recommends users update to the latest version of LabVIEW to mitigate these risks. All vulnerabilities have been assigned a CVSS v3 base score of 7.8 or higher, underscoring their severity and the importance of prompt remediation. No evidence of exploitation in the wild has been reported as of the latest advisories.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
CISA issued advisory ICSA-25-352-03 covering the multiple high-severity NI LabVIEW vulnerabilities, stating there were no known reports of public exploitation and highlighting impact to sectors such as manufacturing, defense, IT, and transportation. The advisory recommended patching supported versions, noted LabVIEW 2021 no longer receives fixes, and credited Michael Heinzl with reporting the issues to CISA.
National Instruments disclosed a set of high-severity vulnerabilities in LabVIEW affecting versions 2021 through 2025 Q3, including out-of-bounds read/write, use-after-free, and stack-based buffer overflow flaws triggered by opening specially crafted VI files. NI published security advisories and patches for supported versions, while noting exploitation requires local user interaction and can lead to information disclosure or arbitrary code execution.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
10 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecisa.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
National Instruments disclosed two high-severity memory corruption vulnerabilities in **NI LabVIEW** that can be triggered when a user opens a specially crafted `.vi` file. **CVE-2026-32862** is an out-of-bounds write in `ResFileFactory::InitResourceMgr()`, and **CVE-2026-32863** is an out-of-bounds read in `sentry_transaction_context_set_operation()`. NI said both flaws can result in information disclosure and may enable arbitrary code execution. The vulnerabilities affect **NI LabVIEW 2026 Q1 (26.1.0) and earlier versions** and require user interaction for successful exploitation. The issues are tracked under **CWE-787** and **CWE-125**, respectively, and were published with high-severity CVSS scoring and vendor advisory references from National Instruments, indicating organizations using LabVIEW should prioritize remediation and treat untrusted VI files as potentially malicious.
Jun 29, 2026
National Instruments disclosed two high-severity memory corruption vulnerabilities in **NI LabVIEW** that can be exploited when a user opens specially crafted project files. **`CVE-2026-32860`** is an out-of-bounds write flaw (`CWE-787`) triggered while LabVIEW loads a corrupted **`.lvlib`** file, while **`CVE-2026-32864`** is an out-of-bounds read issue (`CWE-125`) in `mgcore_SH_25_3!aligned_free()` that can be triggered through a malicious **VI** file. Both flaws may result in information disclosure or arbitrary code execution.
Jun 29, 2026
National Instruments Circuit Design Suite versions 14.3.1 and earlier are affected by two critical memory corruption vulnerabilities, CVE-2025-6033 and CVE-2025-6034. The first vulnerability, CVE-2025-6033, is caused by an out-of-bounds write in the XML_Serialize() function when using the SymbolEditor component. This flaw can result in information disclosure or arbitrary code execution if a user opens a specially crafted .sym file. The second vulnerability, CVE-2025-6034, is due to an out-of-bounds read in the DefaultFontOptions() function, also within the SymbolEditor, and can similarly lead to information disclosure or arbitrary code execution under the same exploitation conditions. Both vulnerabilities require user interaction, specifically opening a malicious .sym file, and are not remotely exploitable without such action. CISA has issued an advisory highlighting that successful exploitation could allow attackers to corrupt memory, potentially leading to the execution of arbitrary code or the disclosure of sensitive information. The vulnerabilities are rated as high severity, with CVSS v4 scores of 8.4 and v3.1 base scores of 7.8, reflecting the significant risk posed to affected systems. The flaws impact sectors such as communications, defense industrial base, and government services, where Circuit Design Suite is commonly deployed. The vulnerabilities stem from improper handling of memory resources, specifically type confusion and out-of-bounds memory access. National Instruments has acknowledged the issues and coordinated disclosure with security researchers and CISA. No evidence suggests that these vulnerabilities are being actively exploited in the wild at this time. Users are advised to avoid opening untrusted .sym files and to apply any available patches or mitigations as soon as they are released. The vulnerabilities highlight the ongoing risks associated with complex file parsing in engineering and design software. Organizations using affected versions should review their security posture and consider additional controls to limit exposure. The advisories recommend monitoring for unusual activity and ensuring that only trusted files are opened within the application. National Instruments has provided contact information for further security guidance and is expected to release updates addressing these vulnerabilities. The disclosure underscores the importance of regular software updates and user awareness in mitigating targeted attacks via crafted files.
Jun 29, 2026