CVE-2025-64462: NI LabVIEW Information Disclosure Flaw

CVE-2025-64462 Overview

CVE-2025-64462 is an out-of-bounds read vulnerability in NI LabVIEW affecting the LVResFile::RGetMemFileHandle() function. The flaw is triggered when LabVIEW parses a corrupted Virtual Instrument (VI) file. Successful exploitation can result in information disclosure or arbitrary code execution on the host system. The vulnerability affects NI LabVIEW 2025 Q3 (25.3) and all prior versions. Exploitation requires an attacker to convince a user to open a specially crafted VI file, making social engineering the primary delivery method. The issue is classified under [CWE-125: Out-of-bounds Read].

Critical Impact

Attackers can achieve arbitrary code execution on engineering and industrial workstations running NI LabVIEW by delivering a malicious VI file.

Affected Products

• NI LabVIEW 2022 (Q1, Q3 and patches Q3 Patch1 through Patch6)
• NI LabVIEW 2023 (Q1, Q3 and patches Q3 Patch1 through Patch7)
• NI LabVIEW 2024 (Q1, Q1 Patch1, Q3 and patches Q3 Patch1 through Patch4)
• NI LabVIEW 2025 (Q1, Q1 Patch1 through Patch3, Q3, Q3 Patch1, Q3 Patch2)

Discovery Timeline

• 2025-12-18 - CVE-2025-64462 published to NVD
• 2025-12-24 - Last updated in NVD database

Technical Details for CVE-2025-64462

Vulnerability Analysis

The vulnerability resides in the LVResFile::RGetMemFileHandle() function within the LabVIEW resource file parser. When LabVIEW opens a VI file, this routine retrieves a memory file handle from the resource structure. A malformed or corrupted VI file can supply length or offset fields that bypass boundary checks, causing the function to read past the end of an allocated buffer.

The out-of-bounds read exposes adjacent process memory to the parsing logic. Depending on how the leaked data is consumed downstream, an attacker can disclose sensitive memory contents such as pointers and stack values. In combination with controlled memory layout, the same primitive can corrupt program state and lead to arbitrary code execution under the privileges of the user running LabVIEW.

Root Cause

The root cause is missing or insufficient validation of length and offset fields in the VI resource record structure before they are used to index into a memory buffer. The parser trusts attacker-controlled metadata embedded in the file, allowing reads beyond the bounds of the intended object.

Attack Vector

Exploitation is local and requires user interaction. An attacker delivers a crafted .vi file via email, removable media, shared engineering repositories, or compromised project archives. When the targeted user opens the file in LabVIEW, the parser dereferences attacker-controlled values inside LVResFile::RGetMemFileHandle(), triggering the out-of-bounds read. No authentication to LabVIEW is required, and no network exposure is needed.

No public proof-of-concept code has been released for this vulnerability. The technical exploitation primitive is described in prose only; refer to the NI Security Update Advisory for vendor-supplied technical details.

Detection Methods for CVE-2025-64462

Indicators of Compromise

• Unexpected LabVIEW.exe crashes or Windows Error Reporting events generated immediately after opening a .vi file from an external source.
• VI files arriving from untrusted email senders, unknown shared drives, or unvetted third-party libraries.
• LabVIEW process spawning unexpected child processes such as cmd.exe, powershell.exe, or rundll32.exe.

Detection Strategies

• Monitor endpoint telemetry for anomalous behavior originating from LabVIEW.exe, including memory access violations, suspicious module loads, or process injection attempts.
• Apply file-content inspection on .vi, .vit, .llb, and related LabVIEW resource files transiting email gateways and file shares.
• Correlate user-opened LabVIEW documents with subsequent suspicious outbound network connections from engineering workstations.

Monitoring Recommendations

• Centralize endpoint logs from engineering and industrial workstations in a SIEM and alert on LabVIEW crash signatures.
• Track LabVIEW version inventory across the fleet to identify hosts still running versions at or below 2025 Q3.
• Monitor file-share access patterns for newly introduced VI files in shared engineering project directories.

How to Mitigate CVE-2025-64462

Immediate Actions Required

• Apply the security update referenced in the NI advisory to all LabVIEW installations at or below version 2025 Q3.
• Restrict opening of VI files to those originating from trusted, verified sources only.
• Educate LabVIEW users on the risk of opening unsolicited or externally sourced VI files.

Patch Information

NI has published guidance and updated installers covering this and related memory corruption issues. Review the NI Security Update Advisory for the fixed versions and download links applicable to each supported LabVIEW release.

Workarounds

• Block inbound VI files at email gateways and web proxies until patching is complete.
• Run LabVIEW under standard user accounts rather than administrative accounts to limit impact of code execution.
• Use application allowlisting to prevent unexpected child processes spawned from LabVIEW.exe.
• Isolate engineering workstations on segmented networks to reduce lateral movement opportunities after compromise.

# Configuration example: inventory LabVIEW installations across Windows hosts
Get-CimInstance -ClassName Win32_Product |
  Where-Object { $_.Name -like "*LabVIEW*" } |
  Select-Object Name, Version, InstallDate