NI LabVIEW up to 22.x/23.3.8/24.3.5/25.3.3/26.1.0 LVCLASS File Parser out-of-bounds write

Summaryinfo

A vulnerability was found in NI LabVIEW up to 22.x/23.3.8/24.3.5/25.3.3/26.1.0. It has been classified as critical. Affected by this vulnerability is an unknown functionality of the component LVCLASS File Parser. This manipulation causes out-of-bounds write. This vulnerability is tracked as CVE-2026-32861. The attack is possible to be carried out remotely. No exploit exists. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability has been found in NI LabVIEW up to 22.x/23.3.8/24.3.5/25.3.3/26.1.0 and classified as critical. Affected by this vulnerability is an unknown code block of the component LVCLASS File Parser. The manipulation with an unknown input leads to a out-of-bounds write vulnerability. The CWE definition for the vulnerability is CWE-787. The product writes data past the end, or before the beginning, of the intended buffer. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

There is a memory corruption vulnerability due to an out-of-bounds write when loading a corrupted LVCLASS file in NI LabVIEW.  This vulnerability may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted .lvclass file. This vulnerability affects NI LabVIEW 2026 Q1 (26.1.0) and prior versions.

The weakness was disclosed by Rocco Calvi. It is possible to read the advisory at ni.com. This vulnerability is known as CVE-2026-32861 since 03/16/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. It demands that the victim is doing some kind of user interaction. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 23.0.0, 23.3.9, 24.3.6, 25.3.4 or 26.1.1 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• NI

Name

• LabVIEW

Version

• 22.x
• 23.3.0
• 23.3.1
• 23.3.2
• 23.3.3
• 23.3.4
• 23.3.5
• 23.3.6
• 23.3.7
• 23.3.8
• 24.3.0
• 24.3.1
• 24.3.2
• 24.3.3
• 24.3.4
• 24.3.5
• 25.3.0
• 25.3.1
• 25.3.2
• 25.3.3
• 26.0
• 26.1.0

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion