CVE-2026-32860

Tuesday, April 07, 2026

7.8

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Summary

There is a memory corruption vulnerability due to an out-of-bounds write when loading a corrupted LVLIB file in NI LabVIEW. This vulnerability may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted .lvlib file. This vulnerability affects NI LabVIEW 2026 Q1 (26.1.0) and prior versions.

Affected Software

Vendor	Product	Version Range	Status
NI	LabVIEW	`0 < 23.0.0`	affected
NI	LabVIEW	`23.1.0 < 23.3.9`	affected
NI	LabVIEW	`24.1.0 < 24.3.6`	affected
NI	LabVIEW	`25.1.0 < 25.3.4`	affected
NI	LabVIEW	`26.1.0 < 26.1.1`	affected

Weaknesses

CWE-787: CWE-787 - Out of Bounds Write

ADP Enrichment

CISA ADP Vulnrichment

SSVC:
Exploitation: none
- Automatable: no
- Technical Impact: total

References

https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/2026/lv-project-library-file-parsing-memory-corruption-vulnerability-in-ni-labview.html

Feedback

Was this page helpful?

Glad to hear it! Please tell us how we can improve.

Sorry to hear that. Please tell us how we can improve.