CVE-2026-64201: NI LabVIEW Memory Corruption RCE Vulnerability

CVE-2026-64201 is a memory corruption RCE vulnerability in NI LabVIEW that enables information disclosure or arbitrary code execution through specially crafted VI files. This article covers technical details, affected versions including 2026 Q3 and prior, impact assessment, and mitigation strategies.

CVE-2026-64201 Overview

CVE-2026-64201 is an out-of-bounds read memory corruption vulnerability in NI LabVIEW that can lead to information disclosure or arbitrary code execution. The flaw affects NI LabVIEW 2026 Q3 (26.3.0) and all prior versions. Exploitation requires a user to open a specially crafted Virtual Instrument (VI) file, making social engineering the primary delivery vector. The vulnerability is classified under CWE-125: Out-of-bounds Read and carries a CVSS 4.0 base score of 8.5. Attack complexity is low, and no privileges are required, but user interaction is mandatory.

Critical Impact
Successful exploitation allows attackers to read process memory or execute arbitrary code with the privileges of the LabVIEW user by tricking a victim into opening a malicious VI file.

Affected Products

NI LabVIEW 2026 Q3 (26.3.0)
All prior versions of NI LabVIEW
Systems where users interactively open externally sourced VI files

Discovery Timeline

2026-08-25 - CVE-2026-64201 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-64201

Vulnerability Analysis

The vulnerability is a memory corruption issue in how LabVIEW parses Virtual Instrument (VI) files. VI files are LabVIEW's proprietary binary container format that stores graphical program code, block diagrams, front panels, and embedded data. When LabVIEW loads a VI, it reads structured fields and length-prefixed data segments from the file. Improper validation of these fields allows an attacker-controlled VI to trigger an out-of-bounds memory read.

An out-of-bounds read can leak sensitive data from adjacent memory regions, including pointers useful for bypassing Address Space Layout Randomization (ASLR). In cases where the corrupted memory influences control flow or object dispatch, the same primitive can be leveraged for arbitrary code execution in the context of the LabVIEW process.

Root Cause

The root cause is insufficient bounds checking during deserialization of untrusted VI file structures [CWE-125]. LabVIEW trusts size or offset fields embedded in the file without validating them against the actual allocated buffer, causing reads past buffer boundaries.

Attack Vector

The attack vector is local and requires user interaction. An attacker crafts a malicious .vi file and delivers it through email, shared drives, code repositories, or third-party LabVIEW libraries. When an engineer or developer opens the file in LabVIEW, the parser processes the malformed structures and triggers the memory corruption. No network exposure or elevated privileges are required.

Exploitation code is not publicly available and the vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog. Technical specifics are described in the NI Security Update Advisory.

Detection Methods for CVE-2026-64201

Indicators of Compromise

Unexpected crashes of LabVIEW.exe shortly after opening a .vi file from an external source
VI files received via email, chat, or downloaded from untrusted repositories immediately prior to instability
Child processes spawned by LabVIEW.exe such as cmd.exe, powershell.exe, or rundll32.exe
Outbound network connections initiated by LabVIEW.exe to unfamiliar hosts after opening a VI

Detection Strategies

Monitor process creation events where LabVIEW.exe is the parent of scripting or living-off-the-land binaries
Alert on Windows Error Reporting (WER) or application crash events referencing LabVIEW.exe with access violation exceptions
Inspect file transfers and email attachments for .vi, .vim, and .llb extensions from untrusted senders

Monitoring Recommendations

Enable command-line and process-tree logging on engineering workstations running LabVIEW
Collect endpoint telemetry for file writes and executions in user profile directories following VI file opens
Track LabVIEW version inventory across the environment to prioritize hosts still running 26.3.0 or earlier

How to Mitigate CVE-2026-64201

Immediate Actions Required

Apply the security update referenced in the NI Security Update Advisory to all LabVIEW installations
Restrict opening of VI files sourced from outside the organization or from untrusted repositories
Educate LabVIEW developers and engineers on the risk of opening unverified .vi files

Patch Information

NI has published a security update addressing this and related memory corruption issues in LabVIEW. Refer to the NI Security Update Advisory for fixed version numbers, download links, and installation guidance for each affected LabVIEW release.

Workarounds

Only open VI files from trusted, internally controlled sources until patching is complete
Isolate LabVIEW development systems on segmented networks with limited outbound connectivity
Run LabVIEW under standard user accounts to limit the impact of successful code execution
Use application allowlisting to block child processes of LabVIEW.exe that are not required for normal operation