BaseFortify

Publication date: 2025-12-18

Last updated on: 2025-12-24

Assigner: National Instruments

Description

There is a use-after-free vulnerability in sentry!sentry_span_set_data() when parsing a corrupted VI file. This vulnerability may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted VI. This vulnerability affects NI LabVIEW 2025 Q3 (25.3) and prior versions

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-18

Last Modified

2025-12-24

Generated

2026-07-06

AI Q&A

2025-12-18

EPSS Evaluated

2026-07-05

NVD

CVE-2025-64468

Affected Vendors & Products

Vendor	Product	Version / Range
ni	labview	2022
ni	labview	2022
ni	labview	2022
ni	labview	2022
ni	labview	2022
ni	labview	2022
ni	labview	2022
ni	labview	2023
ni	labview	2023
ni	labview	2023
ni	labview	2023
ni	labview	2023
ni	labview	2023
ni	labview	2023
ni	labview	2023
ni	labview	2023
ni	labview	2024
ni	labview	2024
ni	labview	2024
ni	labview	2024
ni	labview	2024
ni	labview	2024
ni	labview	2024
ni	labview	2024
ni	labview	2025
ni	labview	2025
ni	labview	2025
ni	labview	2025
ni	labview	2025
ni	labview	2025
ni	labview	2025

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This vulnerability is a use-after-free issue in the function sentry!sentry_span_set_data() that occurs when parsing a corrupted VI file in NI LabVIEW. It can be triggered by an attacker who convinces a user to open a specially crafted VI file, potentially leading to information disclosure or arbitrary code execution.

Impact Analysis

Exploitation of this vulnerability can lead to serious impacts including unauthorized disclosure of sensitive information and the ability for an attacker to execute arbitrary code on the affected system. This could compromise system integrity, confidentiality, and availability.

Hi! I’m here to help you understand CVE-2025-64468. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70