NI LabVIEW up to 26.3.0 Image Loader out-of-bounds

Summaryinfo

A vulnerability described as problematic has been identified in NI LabVIEW up to 22.x/23.3.9/24.3.6/25.3.4/26.3.0. Affected by this vulnerability is an unknown functionality of the component Image Loader. Such manipulation leads to out-of-bounds. This vulnerability is referenced as CVE-2026-18444. The attack can only be performed from a local environment. No exploit is available.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in NI LabVIEW up to 22.x/23.3.9/24.3.6/25.3.4/26.3.0. Affected by this issue is an unknown code block of the component Image Loader. The manipulation with an unknown input leads to a out-of-bounds vulnerability. Using CWE to declare the problem leads to CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. Impacted is confidentiality, integrity, and availability. CVE summarizes:

There is an integer conversion vulnerability resulting in an out-of-bounds read when loading images recently discovered in NI LabVIEW.  This may result in information disclosure or arbitrary code execution.  Successful exploitation requires an attacker to get a user to open a specially crafted VI file.  This vulnerability affects NI LabVIEW 2026 Q3 and prior versions.

The advisory is shared for download at ni.com. This vulnerability is handled as CVE-2026-18444 since 07/31/2026. The exploitation is known to be easy. The attack needs to be approached locally. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available.

Upgrading to version 23.0.0, 23.3.10, 24.3.7, 25.3.5 or 26.3.1 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• NI

Name

• LabVIEW

Version

• 22.x
• 23.3.0
• 23.3.1
• 23.3.2
• 23.3.3
• 23.3.4
• 23.3.5
• 23.3.6
• 23.3.7
• 23.3.8
• 23.3.9
• 24.3.0
• 24.3.1
• 24.3.2
• 24.3.3
• 24.3.4
• 24.3.5
• 24.3.6
• 25.3.0
• 25.3.1
• 25.3.2
• 25.3.3
• 25.3.4
• 26.0
• 26.1
• 26.2
• 26.3.0

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion