CVE-2026-32864
Out-of-Bounds Read in NI LabVIEW Causes Memory Corruption
Publication date: 2026-04-07
Last updated on: 2026-04-13
Assigner: National Instruments
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| ni | labview | 2024 |
| ni | labview | 2023 |
| ni | labview | 2023 |
| ni | labview | 2023 |
| ni | labview | 2023 |
| ni | labview | 2023 |
| ni | labview | 2023 |
| ni | labview | 2024 |
| ni | labview | 2024 |
| ni | labview | 2024 |
| ni | labview | 2023 |
| ni | labview | 2024 |
| ni | labview | 2025 |
| ni | labview | 2025 |
| ni | labview | 2023 |
| ni | labview | 2024 |
| ni | labview | 2025 |
| ni | labview | 2023 |
| ni | labview | 2024 |
| ni | labview | 2024 |
| ni | labview | 2025 |
| ni | labview | 2025 |
| ni | labview | 2025 |
| ni | labview | 2025 |
| ni | labview | to 2022 (inc) |
| ni | labview | 2023 |
| ni | labview | 2024 |
| ni | labview | 2025 |
| ni | labview | 2026 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-125 | The product reads data past the end, or before the beginning, of the intended buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a memory corruption issue caused by an out-of-bounds read in the function mgcore_SH_25_3!aligned_free() within NI LabVIEW. It occurs when a specially crafted VI file is opened by a user, which can lead to unintended behavior.
Exploitation of this vulnerability may allow an attacker to disclose sensitive information or execute arbitrary code on the affected system.
The vulnerability affects NI LabVIEW 2026 Q1 (version 26.1.0) and earlier versions.
How can this vulnerability impact me? :
If exploited, this vulnerability can have serious impacts including information disclosure, where sensitive data may be exposed to unauthorized parties.
Additionally, it can lead to arbitrary code execution, allowing an attacker to run malicious code on your system, potentially compromising system integrity, confidentiality, and availability.
Successful exploitation requires a user to open a specially crafted VI file, so user interaction is necessary.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability may result in information disclosure or arbitrary code execution if a user opens a specially crafted VI file. Such information disclosure could potentially impact compliance with data protection regulations like GDPR or HIPAA, which require safeguarding sensitive information from unauthorized access.
However, the provided information does not specify any direct impact or assessment regarding compliance with these or other common standards and regulations.