CVE-2025-7849

Tuesday, July 29, 2025

7.8

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Summary

A memory corruption vulnerability due to improper error handling when a VILinkObj is null exists in NI LabVIEW that may result in arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted VI. This vulnerability affects NI LabVIEW 2025 Q1 and prior versions.

Affected Software

Vendor	Product	Version Range	Status
NI	LabVIEW	`0 <= 22.3.5`	affected
NI	LabVIEW	`23.0.0 <= 23.3.6`	affected
NI	LabVIEW	`24.0.0 <= 24.3.3`	affected
NI	LabVIEW	`25.0.0 < 25.3.0`	affected

Weaknesses

CWE-1285: CWE-1285

ADP Enrichment

CISA ADP Vulnrichment

SSVC:
Exploitation: none
- Automatable: no
- Technical Impact: total

References

https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/memory-corruption-vulnerabilities-in-ni-labview.html

Feedback

Was this page helpful?

Glad to hear it! Please tell us how we can improve.

Sorry to hear that. Please tell us how we can improve.