Loading story…
National Instruments disclosed two high-severity memory corruption vulnerabilities in NI LabVIEW that can be exploited when a user opens specially crafted project files. CVE-2026-32860 is an out-of-bounds write flaw (CWE-787) triggered while LabVIEW loads a corrupted .lvlib file, while CVE-2026-32864 is an out-of-bounds read issue (CWE-125) in mgcore_SH_25_3!aligned_free() that can be triggered through a malicious VI file. Both flaws may result in information disclosure or arbitrary code execution.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
NI recorded CVE-2026-32864 on 2026-04-07 for an out-of-bounds read in mgcore_SH_25_3!aligned_free() triggered by opening a specially crafted VI file. The vulnerability affects LabVIEW 2026 Q1 (26.1.0) and prior versions and could lead to information disclosure or arbitrary code execution.
NI recorded CVE-2026-32860 on 2026-04-07 for an out-of-bounds write in LabVIEW when loading a corrupted .lvlib file. The issue affects LabVIEW 2026 Q1 (26.1.0) and earlier versions and may allow information disclosure or arbitrary code execution with user interaction.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
National Instruments disclosed two high-severity memory corruption vulnerabilities in **NI LabVIEW** that can be triggered when a user opens a specially crafted `.vi` file. **CVE-2026-32862** is an out-of-bounds write in `ResFileFactory::InitResourceMgr()`, and **CVE-2026-32863** is an out-of-bounds read in `sentry_transaction_context_set_operation()`. NI said both flaws can result in information disclosure and may enable arbitrary code execution. The vulnerabilities affect **NI LabVIEW 2026 Q1 (26.1.0) and earlier versions** and require user interaction for successful exploitation. The issues are tracked under **CWE-787** and **CWE-125**, respectively, and were published with high-severity CVSS scoring and vendor advisory references from National Instruments, indicating organizations using LabVIEW should prioritize remediation and treat untrusted VI files as potentially malicious.
Jun 29, 2026
Several high-severity vulnerabilities have been identified in NI LabVIEW, affecting version 2025 Q3 (25.3) and earlier. These vulnerabilities include out-of-bounds reads and writes, stack-based buffer overflows, and use-after-free conditions in various LabVIEW components such as `LVResFile::FindRsrcListEntry()`, `mgocre_SH_25_3!RevBL()`, `LVResource::DetachResource()`, and `sentry!sentry_span_set_data()`. Exploitation of these flaws requires a user to open a specially crafted VI file, potentially leading to information disclosure or arbitrary code execution. The vulnerabilities are not remotely exploitable but pose significant risk if a malicious file is opened on a vulnerable system. CISA has issued an advisory confirming that these vulnerabilities (CVE-2025-64461 through CVE-2025-64469) impact critical infrastructure sectors, including manufacturing, defense, IT, and transportation. The advisory recommends users update to the latest version of LabVIEW to mitigate these risks. All vulnerabilities have been assigned a CVSS v3 base score of 7.8 or higher, underscoring their severity and the importance of prompt remediation. No evidence of exploitation in the wild has been reported as of the latest advisories.
Jun 29, 2026
National Instruments Circuit Design Suite versions 14.3.1 and earlier are affected by two critical memory corruption vulnerabilities, CVE-2025-6033 and CVE-2025-6034. The first vulnerability, CVE-2025-6033, is caused by an out-of-bounds write in the XML_Serialize() function when using the SymbolEditor component. This flaw can result in information disclosure or arbitrary code execution if a user opens a specially crafted .sym file. The second vulnerability, CVE-2025-6034, is due to an out-of-bounds read in the DefaultFontOptions() function, also within the SymbolEditor, and can similarly lead to information disclosure or arbitrary code execution under the same exploitation conditions. Both vulnerabilities require user interaction, specifically opening a malicious .sym file, and are not remotely exploitable without such action. CISA has issued an advisory highlighting that successful exploitation could allow attackers to corrupt memory, potentially leading to the execution of arbitrary code or the disclosure of sensitive information. The vulnerabilities are rated as high severity, with CVSS v4 scores of 8.4 and v3.1 base scores of 7.8, reflecting the significant risk posed to affected systems. The flaws impact sectors such as communications, defense industrial base, and government services, where Circuit Design Suite is commonly deployed. The vulnerabilities stem from improper handling of memory resources, specifically type confusion and out-of-bounds memory access. National Instruments has acknowledged the issues and coordinated disclosure with security researchers and CISA. No evidence suggests that these vulnerabilities are being actively exploited in the wild at this time. Users are advised to avoid opening untrusted .sym files and to apply any available patches or mitigations as soon as they are released. The vulnerabilities highlight the ongoing risks associated with complex file parsing in engineering and design software. Organizations using affected versions should review their security posture and consider additional controls to limit exposure. The advisories recommend monitoring for unusual activity and ensuring that only trusted files are opened within the application. National Instruments has provided contact information for further security guidance and is expected to release updates addressing these vulnerabilities. The disclosure underscores the importance of regular software updates and user awareness in mitigating targeted attacks via crafted files.
Jun 29, 2026