CVE-2026-32864: NI LabVIEW Memory Corruption RCE Vulnerability

CVE-2026-32864 Overview

A memory corruption vulnerability exists in NI LabVIEW due to an out-of-bounds read in the mgcore_SH_25_3!aligned_free() function. This security flaw may result in information disclosure or arbitrary code execution when a user opens a specially crafted VI file. The vulnerability requires user interaction for successful exploitation, making it a targeted attack vector that could be leveraged through social engineering or malicious file distribution.

Critical Impact

Successful exploitation of this vulnerability could allow attackers to execute arbitrary code or disclose sensitive information on systems running vulnerable versions of NI LabVIEW, potentially compromising industrial automation and measurement systems.

Affected Products

• NI LabVIEW 2026 Q1 (version 26.1.0)
• NI LabVIEW versions prior to 2026 Q1

Discovery Timeline

• 2026-04-07 - CVE-2026-32864 published to NVD
• 2026-04-08 - Last updated in NVD database

Technical Details for CVE-2026-32864

Vulnerability Analysis

This vulnerability is classified under CWE-125 (Out-of-Bounds Read), a memory safety issue where the software reads data past the end or before the beginning of the intended buffer. In the context of NI LabVIEW, the vulnerability resides in the memory management component, specifically within the mgcore_SH_25_3!aligned_free() function.

The out-of-bounds read condition occurs during memory deallocation operations when processing VI (Virtual Instrument) files. When a maliciously crafted VI file is opened, it can trigger improper memory access patterns that lead to reading memory locations outside the allocated buffer boundaries.

This type of vulnerability can have dual impact: it may expose sensitive memory contents (information disclosure) or corrupt memory state in ways that enable arbitrary code execution. The local attack vector combined with the requirement for user interaction indicates that exploitation typically requires convincing a user to open a malicious VI file.

Root Cause

The root cause stems from insufficient bounds checking in the aligned_free() memory management function within the mgcore_SH_25_3 module. When processing specially crafted VI files, the function fails to properly validate memory boundaries before performing read operations, allowing access to memory regions outside the intended allocation. This represents a classic memory safety vulnerability where input validation does not adequately constrain memory access operations.

Attack Vector

The attack requires local access and user interaction. An attacker must craft a malicious VI file that, when opened by a victim using NI LabVIEW, triggers the out-of-bounds read condition. Attack scenarios include:

The vulnerability manifests when the mgcore_SH_25_3!aligned_free() function processes malformed data structures within a VI file, causing the application to read beyond allocated memory boundaries. Attackers could potentially leverage this to leak sensitive information from adjacent memory regions or manipulate program execution flow if the corrupted memory state can be controlled. For detailed technical analysis, refer to the NI Security Update Advisory.

Detection Methods for CVE-2026-32864

Indicators of Compromise

• Unexpected crashes or abnormal termination of NI LabVIEW when opening VI files
• Memory access violation errors or segmentation faults in LabVIEW processes
• Presence of suspicious or unknown VI files from untrusted sources in project directories
• Anomalous memory consumption patterns in LabVIEW applications

Detection Strategies

• Monitor process behavior for NI LabVIEW applications, looking for unexpected memory access patterns or crashes
• Implement endpoint detection rules to identify exploitation attempts targeting the mgcore_SH_25_3 module
• Deploy file integrity monitoring for VI file directories to detect potentially malicious file introductions
• Use application whitelisting to prevent execution of unauthorized or modified LabVIEW components

Monitoring Recommendations

• Enable detailed logging for LabVIEW application events and system crashes
• Configure SIEM rules to alert on repeated LabVIEW crashes or memory violation events
• Monitor for unusual file access patterns involving VI files from external or untrusted sources
• Implement user behavior analytics to detect social engineering attempts involving VI file sharing

How to Mitigate CVE-2026-32864

Immediate Actions Required

• Update NI LabVIEW to the latest patched version as provided by National Instruments
• Restrict the opening of VI files from untrusted or unknown sources
• Implement strict file handling policies for engineering workstations running LabVIEW
• Enable security features in your endpoint protection solution to detect memory corruption exploits

Patch Information

National Instruments has released security updates to address this vulnerability. Users should apply the patches detailed in the NI Security Update Advisory. It is critical to update all affected installations of NI LabVIEW 2026 Q1 (26.1.0) and prior versions to the remediated release.

Workarounds

• Do not open VI files received from untrusted sources or via unverified channels
• Isolate LabVIEW workstations from general network access where possible
• Run LabVIEW with reduced privileges and in sandboxed environments when testing untrusted VI files
• Implement network segmentation to limit exposure of systems running vulnerable LabVIEW versions

# Verify installed LabVIEW version and check for updates
# Navigate to Help > About LabVIEW to confirm version number
# Ensure version is updated beyond 26.1.0 per NI security advisory