NI LabVIEW Vulnerable to Information Disclosure via VI File Parsing Flaw
A critical vulnerability in NI LabVIEW allows remote attackers to disclose sensitive information through a flaw in VI file parsing, requiring user interaction to exploit.
National Instruments (NI) LabVIEW, a widely used graphical programming environment for data acquisition and instrument control, is affected by an information disclosure vulnerability. The flaw, identified as ZDI-26-630 and assigned CVE-2026-18445, stems from an integer overflow within the software's VI file parsing mechanism. This vulnerability could allow remote attackers to gain access to sensitive information on affected systems.
The vulnerability arises from the improper validation of user-supplied data during the parsing of VI (Virtual Instrument) files. This oversight can lead to an integer overflow condition before memory is read, creating an opportunity for attackers. Successful exploitation would enable an attacker to disclose information within the context of the currently running process, potentially revealing system details or other sensitive data.
Exploitation of this vulnerability requires a degree of user interaction. Attackers would typically need to trick a user into visiting a malicious webpage that hosts a crafted VI file or opening a specially designed malicious file. This dependency on user action, while a mitigating factor, does not diminish the severity of the potential information disclosure.
The Common Vulnerability Scoring System (CVSS) has assigned this vulnerability a score of 3.3, categorizing it as low severity. However, the potential for information disclosure in industrial and scientific environments where LabVIEW is prevalent warrants careful attention. The specific impact can vary depending on the data accessible within the compromised process.
National Instruments has addressed this vulnerability by releasing an update. Users of NI LabVIEW are strongly advised to apply the available patches to mitigate the risk. Further details regarding the update and the specific software versions affected can be found on NI's official security support page.
The vulnerability was initially reported to the vendor on June 30, 2026. Following a coordinated disclosure process, Zero Day Initiative (ZDI) publicly released the advisory on September 9, 2026, with an update to the advisory on the same day. The research leading to the discovery of this flaw is credited to Grigory Dorodnov of TrendAI Research.
This disclosure highlights the ongoing challenges in securing complex software environments, particularly those used in critical infrastructure and research. Even seemingly low-severity vulnerabilities can have significant implications if they can be chained with other exploits or if they occur in highly sensitive operational contexts. Organizations using NI LabVIEW should prioritize patching to maintain the integrity and confidentiality of their systems.
While the CVSS score is low, the nature of information disclosure vulnerabilities means that attackers could potentially gather intelligence to plan more sophisticated attacks. It underscores the importance of a layered security approach and continuous vigilance in software supply chain security.
The Zero Day Initiative advisory ZDI-26-631 provides further technical details on the NI LabVIEW VI file parsing vulnerability, identified as CVE-2026-18444. It specifies that the flaw is an out-of-bounds read resulting from improper validation of user-supplied data within VI file parsing, allowing attackers to disclose information in the context of the current process. The advisory also credits Grigory Dorodnov of TrendAI Research for discovering the vulnerability.