CVE-2026-64201

Executive Summary

CVE-2026-64201 is a memory corruption vulnerability in NI LabVIEW, a widely deployed graphical development environment used for instrumentation, test, measurement, and industrial control workloads. Exploitation requires a user to open a specially crafted Virtual Instrument (VI) file, after which the flaw may result in information disclosure or arbitrary code execution in the context of the LabVIEW process. Versions up to and including LabVIEW 2026 Q3 (26.3.0) are stated as affected, with a CVSS base score of 7.8 reflecting high confidentiality, integrity, and availability impact at the local attack vector.

Technical Analysis

The vulnerability is classified as CWE-125, an out-of-bounds read, under the broader category of memory corruption. NI's advisory text states that the issue was "recently discovered" and that it may lead to information disclosure or arbitrary code execution. The precise parsing routine, attribute, or data structure involved is not disclosed in the available data, so the analysis below is scoped to the vulnerability class rather than to specific code paths.

In LabVIEW, a VI file is a structured container that holds block diagram data, front panel control and indicator definitions, type descriptors, and compiled code metadata. When LabVIEW opens a VI, it parses these structures and reconstructs the in-memory representation of the diagram. A CWE-125 condition arises when a length, index, offset, or count field read from the file is not validated against the actual size of the buffer it indexes into. The parser then reads past the end of an allocated buffer. Because the malformed data is attacker-controlled, the out-of-bounds read can be shaped by choosing the over-large or negative value in the crafted file.

Two outcomes are described: information disclosure and arbitrary code execution. Information disclosure follows from out-of-bounds reads into adjacent heap or object memory, where the read content may be surfaced through the application (for example, rendered, logged, or otherwise returned to an attacker-influenced output path). Arbitrary code execution is the more severe consequence. Out-of-bounds reads frequently pair with adjacent memory-corruption primitives; when an attacker can read past a buffer boundary into memory containing pointers or length fields, the same malformed input can often be leveraged to achieve a write or to corrupt control data, ultimately redirecting execution. The advisory does not enumerate which of these primitives is present, so the exact progression from read to code execution is not documented.

The attack surface is the VI file parser. It is reachable whenever a user opens a VI, whether by double-clicking the file, loading it through the LabVIEW IDE, or having it pulled in as a subVI by another instrument project. The CVSS vector indicates network attack complexity is low and no privileges are required (PR:N), but user interaction is required (UI:R) and the attack vector is local (AV:L) — consistent with the requirement that a victim open a malicious VI from local storage or a mounted share.

Exploitation Scenarios

No public proof-of-concept is referenced in the provided data (Exploit Code: NO, Nuclei Template: NO), though the PoC status field is recorded as Public. The attack chain below is therefore described at the vulnerability-class level and is inferred from the CWE-125 classification and the stated exploitation requirement; it does not rely on any specific function name, file path, or parameter that is not present in the source description.

1. Reconnaissance and target identification. The attacker identifies an environment that uses NI LabVIEW for engineering, test, or control workflows. Relevant targets are engineering workstations, test benches, and lab systems where VI files are routinely exchanged over email, collaboration platforms, shared network drives, or version-control repositories used by instrumentation teams. The attacker needs a delivery path to a user who will open a VI.

2. Triggering the flaw class. The attacker constructs a VI file whose internal size, length, or index fields are inconsistent with the actual data present — for example, a value that causes the parser to read beyond an allocated buffer when the file is loaded. Delivery is via social engineering or a trusted-looking artifact: a "shared measurement," a "fix" to an existing VI, or a file placed in a location the target monitors. The victim opens the file in LabVIEW, causing the parser to process the malformed structure and perform the out-of-bounds read.

3. Payload and execution. At the vulnerability-class level, the crafted file places the out-of-bounds condition in a state where the read accesses memory the attacker can influence or where the same malformed structure enables memory corruption. If the primitive can be escalated to a write, the attacker can redirect control flow to code of their choosing within the LabVIEW process context. If not, the outcome is limited to disclosure of memory contents. The description does not confirm which primitive is achievable, so both outcomes should be treated as plausible during triage.

4. Post-exploitation impact. Because LabVIEW runs with the privileges of the logged-on user and typically has access to hardware interfaces, project files, and often network shares, code execution yields that user's file and network access. In engineering and OT-adjacent environments, this can provide a foothold for lateral movement, tampering with measurement or control projects, or exfiltrating proprietary design and test data. Information disclosure alone may leak memory contents that aid further exploitation or reveal sensitive project data.

Impact Assessment

The CVSS 3.1 base score is 7.8 (High) with vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The scope is unchanged, so impact is confined to the LabVIEW process and its resources. Confidentiality, integrity, and availability are each rated High. Low attack complexity and no required privileges mean the only meaningful barrier is the user interaction needed to open the malicious VI. Availability is rated High because memory corruption in a parsing routine can crash or destabilize the application and potentially the workstation.

The blast radius is defined by where LabVIEW is installed. This is typically an engineering workstation rather than a server, so direct exposure to the internet is low. However, the value of those workstations is high: they frequently hold proprietary designs, calibration data, and access to test hardware and adjacent networks. EPSS is 0.00188 (7.5th percentile), indicating that current exploitation probability in the wild is assessed as low, and the CVE is not in CISA KEV. The risk is nonetheless material for organizations with LabVIEW users who regularly open VI files from external parties, because the attack requires only that a user open a file.

Detection Guidance

Sigma Rule

title: Suspicious NI LabVIEW VI File Load Followed by Child Process
id: 7b1a6e42-0c9d-4f5e-9a3c-2d8e6f1b4a77
status: experimental
description: Detects LabVIEW process loading a VI file from a user-writable or temporary location and spawning a child process, which may indicate exploitation of CVE-2026-64201.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-64201
author: Threat Intelligence
date: 2026/01/01
tags:
  - attack.t1203
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\LabVIEW.exe'
  selection_susp_location:
    Image|contains:
      - '\Temp\'
      - '\Downloads\'
      - '\AppData\Local\Temp\'
      - '\Public\'
  condition: selection_parent and selection_susp_location
fields:
  - Image
  - ParentImage
  - CommandLine
  - User
falsepositives:
  - Legitimate LabVIEW plugins or tooling that spawn helper processes from temporary directories
level: medium

YARA Rule

rule CVE_2026_64201_LabVIEW_Malformed_VI
{
    meta:
        description = "Heuristic detection of LabVIEW VI files exhibiting malformed size/offset fields consistent with CVE-2026-64201 (CWE-125)"
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-64201"
        hash = "n/a"

    strings:
        $vi_magic = { 52 53 52 43 }          // "RSRC" block identifier common in LabVIEW VI containers
        $lv_vers  = "LV" ascii
        $bdfr     = { 42 44 48 43 }          // "BDHC" / block diagram header family markers
        $big_len  = { FF FF FF 7F }          // suspicious near-max 32-bit length field
        $neg_len  = { 00 00 00 80 }          // suspicious sign-bit length field

    condition:
        ($vi_magic at 0 or $vi_magic) and filesize < 50MB and
        (uint32(0) == 0x43525352) and
        any of ($lv_vers, $bdfr) and
        2 of ($big_len, $neg_len)
}

Suricata IDS Rule

alert smb any any -> any any (msg:"CVE-2026-64201 NI LabVIEW VI File Transfer Attempt"; flow:established,to_server; content:"|52 53 52 43|"; offset:0; depth:4; content:"LV"; within:64; fileext:"vi"; filestore; sid:90064201; rev:1; metadata:created_at 2026_01_01, cve CVE-2026-64201; classtype:attempted-user; reference:nvd,https://nvd.nist.gov/vuln/detail/CVE-2026-64201;)

Elastic Detection

process where process.parent.name == "LabVIEW.exe" and
  (process.executable : ("*\\Temp\\*", "*\\Downloads\\*", "*\\AppData\\Local\\Temp\\*", "*\\Public\\*"))

Splunk SPL Query

index=endpoint (Image="*\\LabVIEW.exe" OR ParentImage="*\\LabVIEW.exe")
| eval risk=case(ParentImage="*\\LabVIEW.exe" AND match(Image,"(?i)(temp|downloads|public|appdata)"),"high", true(),"low")
| where risk="high"
| table _time, host, user, ParentImage, Image, CommandLine, risk
| sort - _time

Wazuh OSSEC Rule

<group name="labview,cve_2026_64201,">
  <rule id="100642" level="10">
    <if_sid>61603</if_sid>
    <field name="win.eventdata.parentImage">LabVIEW\.exe$</field>
    <field name="win.eventdata.image">(?i)(Temp|Downloads|Public|AppData.Local.Temp)\\.*\.exe$</field>
    <description>CVE-2026-64201: Possible NI LabVIEW exploitation - child process spawned from untrusted path by LabVIEW</description>
    <mitre>
      <id>T1203</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — a single source claims a patch is available, not independently confirmed). NVD states the vulnerability affects NI LabVIEW 2026 Q3 (26.3.0) and prior versions. No vendor advisory URL, fixed version string, or workaround was supplied in the source data.

1. Immediate mitigations.

• Treat VI files from external or untrusted sources as potentially hostile. Restrict inbound VI files via email and collaboration tooling, and require users to open them only after scanning and review.
• Block or quarantine VI file downloads and transfers at the perimeter and email gateway where operationally feasible.
• Enable application control or a policy that confines LabVIEW to expected working directories so a user is less likely to open an unsolicited VI from a download or temporary folder.
• Run LabVIEW workstations with standard user privileges and enforce least privilege so a successful exploit does not immediately inherit administrative rights.
• Segment engineering and test workstations from general IT and OT networks to limit lateral movement following compromise.

2. Patch and upgrade steps.

• Contact NI support or check the NI product security advisory page to confirm the fixed LabVIEW release and obtain the exact remediated build number, since the source data does not identify it.
• Upgrade to the vendor-confirmed fixed version. Because the patch is only CLAIMED at this time, verify the fix independently through NI's advisory or support before considering the issue closed.
• If no fixed version is available for a required legacy release, isolate affected workstations until supported.

3. Long-term hardening.

• Maintain a Software Bill of Materials for engineering tooling and subscribe to NI security advisories for early notification.
• Keep LabVIEW and its toolkits current on a defined patch cadence.
• Apply code signing and allowlisting for VI files where the workflow permits, and audit shared repositories used by instrumentation teams.
• Log VI file provenance and retain process-creation telemetry from LabVIEW workstations for retrospective hunting with the rules above.
• Validate that engineering workstations are included in endpoint detection and vulnerability management scope; they are often overlooked because they are not general-purpose servers.

References

• NVD — CVE-2026-64201: https://nvd.nist.gov/vuln/detail/CVE-2026-64201
• CWE-125: Out-of-bounds Read: https://cwe.mitre.org/data/definitions/125.html
• NI Product Security / advisory portal: consult NI's official product security center for the vendor advisory and fixed version for LabVIEW 2026 Q3 and earlier.
• FIRST EPSS: https://www.first.org/epss/ (CVE-2026-64201 score 0.00188, ~7.5th percentile)
• CISA Known Exploited Vulnerabilities catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-64201 not listed at time of writing)

Threat actor and in-the-wild evidence: none available. The CVE is not listed in CISA KEV, EPSS indicates low exploitation likelihood, and no public exploit code or Nuclei template is referenced in the provided data. The Public PoC status field should be verified against an authoritative source before it is treated as confirmed.