CVE-2026-64202

Executive Summary

CVE-2026-64202 is an out-of-bounds read (CWE-125) memory corruption vulnerability in NI LabVIEW, the graphical system-design and instrumentation platform. The flaw is reachable when a user opens a specially crafted Virtual Instrument (VI) file, and successful exploitation may lead to information disclosure or arbitrary code execution in the context of the LabVIEW process. All releases up to and including NI LabVIEW 2026 Q3 (26.3.0) are reported as affected. No public proof-of-concept, Nuclei template, or exploit code is currently available, and the vulnerability has not been added to CISA KEV; EPSS is 0.00188 (7.5th percentile), indicating low near-term exploitation likelihood in the wild.

Technical Analysis

The vulnerability is classified as CWE-125: Out-of-bounds Read. This is a memory-safety defect in which a program reads data outside the bounds of an allocated buffer, typically because a length, index, or offset value drawn from attacker-controlled input is not validated against the buffer's true size before a read operation is performed.

The attack surface is the VI file parser and loader inside NI LabVIEW. A VI is a structured binary file containing graphical block-diagram data, front-panel control definitions, compiled code segments, and metadata. When LabVIEW opens a VI, its deserialization and load routines read length-prefixed fields, offsets, and array dimensions from the file and use them to index into in-memory structures. Because the NVD description does not disclose the specific parsing function, structure name, offset field, or file section where the bounds check is missing, no code-level enumeration of the defective routine can be provided; the mechanism must be described at the vulnerability-class level.

An out-of-bounds read in this context produces two possible outcomes, both consistent with the NVD impact statement:

1. Information disclosure. An over-read can copy adjacent heap or stack memory into a data structure that LabVIEW subsequently renders, processes, or exposes — for example through a control value, error output, or generated artifact. This can leak pointers, heap metadata, or other process memory that defeats ASLR and supports a follow-on exploit.

2. Arbitrary code execution. While CWE-125 is nominally a read primitive, out-of-bounds reads are frequently an early stage of a broader memory-corruption chain. A malformed length or offset can drive a subsequent write, or the leaked memory can be used to construct a reliable second-stage payload against a related corruption in the same parsing path. The CVSS subscore C:H/I:H/A:H reflects this full-compromise potential (high confidentiality, integrity, and availability impact), which is inconsistent with a pure read-only information leak and suggests the defect can be leveraged further than a simple disclosure.

The CVSS vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (7.8 High) is the defining characteristic of this bug's exploitability profile:

• AV:L (Local): The attacker cannot reach the vulnerable parser remotely. The VI must already be present on the target host or transferred to it.
• AC:L (Low): No special race condition or complex precondition is required beyond the file being opened.
• PR:N (None): No privileges or credentials are needed to trigger parsing.
• UI:R (User Interaction Required): The victim must actively open the crafted VI.
• S:U (Unchanged): The vulnerable component's authority is not exceeded; impact remains within the LabVIEW process security context.
• C:H/I:H/A:H: Full impact to confidentiality, integrity, and availability of the affected host process.

This places CVE-2026-64202 squarely in the client-side, file-parser memory-corruption class: weaponization requires social engineering to deliver the VI and induce a victim to open it, after which code execution is code-executed in the user's LabVIEW context.

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template is available for CVE-2026-64202. The attack chain below is therefore inferred strictly from the vulnerability class (CWE-125 out-of-bounds read in a file parser) and the CVSS vector, without fabricating specific implementation details such as function names, field offsets, or VI section identifiers that are not present in the source data.

1) Reconnaissance / target identification. The attacker identifies environments that use NI LabVIEW — engineering, test-and-measurement, industrial control, and academic labs, plus any desktop or engineering workstation where LabVIEW is installed. Targets are selected by role (engineers who routinely open VIs from shared drives, email attachments, USB media, or downloaded example repositories) rather than by network exposure, because the vector is AV:L. No remote scanning is required; identification can be passive (job postings, vendor lists, public code repositories hosting VIs).

2) Triggering the flaw class. The attacker crafts a VI file whose internal length, offset, or array-dimension metadata is malformed so that, when LabVIEW's loader parses it, a bounds check is bypassed and memory outside the intended buffer is read. Delivery relies on the user-interaction requirement (UI:R): the file is sent as an email attachment, hosted on a file-sharing link, planted on a shared engineering drive, or dropped on removable media, and the attacker persuades the victim to open it in LabVIEW. This is the T1204.002 (User Execution: Malicious File) step.

3) Execution at the vulnerability-class level. On open, LabVIEW parses the VI and performs the out-of-bounds read before or during block-diagram/front-panel processing. Because the specific defective routine is not disclosed in the available data, the exact pivot from read to write cannot be enumerated. At the class level, the disclosed impact ("information disclosure or arbitrary code execution") means either the over-read directly leaks process memory the attacker can observe, or the over-read is leveraged as a component of a memory-corruption chain that yields control-flow or data manipulation within the LabVIEW process. No shellcode layout, ROP chain, or heap-grooming technique can be asserted because no public analysis exists for this CVE.

4) Post-exploitation impact. If code execution is achieved, the attacker operates in the security context of the user running LabVIEW (S:U — unchanged). From an engineering workstation this context frequently carries access to source repositories, instrument control networks, shared design data, and potentially OT/ICS-adjacent lab equipment. Even where only information disclosure is achieved, leaked memory can disclose sensitive design data or process internals and can be used to defeat ASLR for a follow-on exploit against the same or a related parser bug.

Impact Assessment

• Confidentiality (C:H): Memory over-reads can disclose process memory, including pointers and potentially sensitive engineering or project data held in the LabVIEW process.
• Integrity (I:H): Arbitrary code execution, if achieved, allows modification of files, project data, or the integrity of the engineering workflow and any output the host produces.
• Availability (A:H): Memory corruption can crash the LabVIEW process and, in a weaponized scenario, destabilize or fully control the host.
• Attack vector (AV:L) and user interaction (UI:R) limit remote, unauthenticated mass exploitation; the bug is not wormable and is not internet-facing.
• Scope (S:U): impact is confined to the vulnerable LabVIEW process context; no privilege boundary is crossed by the flaw itself, so post-exploitation privilege escalation would require additional techniques.
• Blast radius: any host running NI LabVIEW — predominantly engineering workstations, test benches, and lab/OT-adjacent systems. In environments where engineering workstations are dual-homed or bridge corporate IT and instrument networks, host compromise can provide a foothold into sensitive design and control environments.

The base score of 7.8 (High) reflects full C/I/A impact tempered by local vector and required user interaction. With no public exploit, EPSS at 0.00188 (7.5th percentile), and no KEV listing, near-term exploitation in the wild is assessed as unlikely, but the file-parser delivery model makes targeted spear-phishing against engineering staff a credible threat model.

Detection Guidance

Detection for a client-side file-parser memory-corruption bug is best approached as a layered problem: catch delivery of suspicious VI files, catch the parsing/crash event on the endpoint, and correlate both. Because the exact crafted-file pattern is not published, the rules below key on behavioral and structural indicators (LabVIEW opening a VI from an unusual source, VI file heuristics, LabVIEW process crashes) rather than on a known byte signature.

Sigma Rule

title: Suspicious VI File Opened by NI LabVIEW from User-Writable or Remote Path
id: 3f7c1a92-6b21-4e0a-9d5f-20266420cafe
status: experimental
description: Detects NI LabVIEW launching with a VI argument sourced from a temporary,
  download, email-attachment, or UNC path, consistent with delivery of a crafted VI
  for CVE-2026-64202 (out-of-bounds read in the VI parser).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-64202
author: Threat Intelligence
date: 2026/01/01
tags:
  - attack.user-execution
  - attack.t1204.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\LabVIEW.exe'
  selection_path:
    CommandLine|contains:
      - '\.vi '
      - '\.vi"'
  selection_suspicious_location:
    CommandLine|contains:
      - '\AppData\Local\Temp\'
      - '\Downloads\'
      - '\Outlook'
      - '\Attachments\'
      - '\Users\Public\'
      - '\\'
  condition: selection_img and selection_path and selection_suspicious_location
falsepositives:
  - Legitimate engineering workflows opening VIs from network shares or download folders
level: medium

YARA Rule

rule CVE_2026_64202_LabVIEW_VI_Suspicious_Parser_Input
{
    meta:
        author = "Threat Intelligence"
        description = "Heuristic detection of VI files with anomalous internal length/offset metadata potentially targeting the NI LabVIEW parser (CVE-2026-64202, CWE-125). Tuning required; not a definitive signature."
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-64202"
        date = "2026-01-01"
        severity = "medium"

    strings:
        // LabVIEW VI files are RSrc/RsrC container formats; match common VI container markers
        $vi_magic1 = "RSrc" ascii
        $vi_magic2 = "LVIN" ascii
        $vi_magic3 = "LVzp" ascii
        // Embedded server/LabVIEW version markers frequently present in VI headers
        $vi_ver1 = "LabVIEW" ascii
        $vi_ver2 = "NI-VI" ascii

    condition:
        (uint16(0) == 0x5265 or $vi_magic1 or $vi_magic2 or $vi_magic3) and
        any of ($vi_magic1, $vi_magic2, $vi_magic3, $vi_ver1, $vi_ver2) and
        filesize < 50MB
}

Suricata IDS Rule

alert smb any any -> any any (msg:"CVE-2026-64202 Possible Delivery of Crafted NI LabVIEW VI File Over SMB"; flow:to_server,established; dsize:>0; content:"|FF FE|"; content:".vi"; nocase; within:200; content:"RSrc"; nocase; within:2; classtype:attempted-user; sid:2026642; rev:1; metadata:affected_product NI_LabVIEW, cve CVE-2026-64202, created_at 2026_01_01; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-64202;)

Elastic Detection

process where process.name == "LabVIEW.exe" and
  process.command_line : ("*.vi*") and
  (
    process.command_line : ("*\\AppData\\Local\\Temp\\*",
                            "*\\Downloads\\*",
                            "*\\Outlook*",
                            "*\\Attachments\\*",
                            "*\\Users\\Public\\*",
                            "*\\\\*")
  )

Splunk SPL Query

index=endpoint sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=1
(Image="*\\LabVIEW.exe" OR Image="*\\labview.exe")
(CommandLine="*.vi*")
(CommandLine="*\\Temp\\*" OR CommandLine="*\\Downloads\\*" OR CommandLine="*\\Outlook*" OR CommandLine="*\\Attachments\\*" OR CommandLine="*\\Users\\Public\\*" OR CommandLine="*\\\\*")
| stats count min(_time) as first_seen max(_time) as last_seen
        values(CommandLine) as command_line
        by ComputerName, User, Image, ParentImage
| sort - first_seen

Wazuh OSSEC Rule

<group name="windows,attack,t1204,">
  <rule id="2026642" level="10">
    <if_sid>60000</if_sid>
    <field name="win.eventdata.image">(?i)\\LabVIEW\.exe$</field>
    <field name="win.eventdata.commandLine">(?i)\.vi([" ]|$)</field>
    <field name="win.eventdata.commandLine">(?i)(\\Temp\\|\\Downloads\\|\\Outlook|\\Attachments\\|\\Users\\Public\\|\\\\)</field>
    <description>CVE-2026-64202: NI LabVIEW opened a VI from a suspicious or remote path - possible crafted-VI delivery.</description>
    <mitre>
      <id>T1204.002</id>
    </mitre>
    <group>user_execution,memory_corruption,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch (not independently confirmed)). Consulting the vendor's official advisory and release notes directly is advised before relying on the claimed fix; no vendor advisory, patch version, or workaround is present in the data available for this report.

1) Immediate mitigations (while patch status is unverified):

• Treat untrusted VI files as executable content. Block or quarantine *.vi attachments at the email gateway and web proxy.
• Restrict VI acquisition to trusted, internal repositories; disable or warn on VI execution from removable media and user-writable download/temp directories where policy allows.
• Run LabVIEW on workstations with least privilege; do not operate engineering workstations with local administrator rights or standing access to instrument/OT networks.
• Apply application allow-listing so only vetted VIs and plugins load, and enable OS-level exploit mitigations (ASLR, DEP/CFG, and where supported, Microsoft Defender Exploit Guard / Attack Surface Reduction rules) for LabVIEW.exe.
• Segment engineering workstations from corporate IT and instrument networks to limit lateral movement if a host is compromised.

2) Patch / upgrade steps:

• Confirm the fixed build directly with NI's security advisory and release notes for LabVIEW. The supplied data only indicates a claimed fix reference via NVD for LabVIEW 2026 Q3 (26.3.0); treat this as unconfirmed until the vendor advisory is reviewed.
• Inventory all LabVIEW installations and versions; the affected range is reported as 2026 Q3 (26.3.0) and all prior versions.
• Upgrade to the vendor-confirmed fixed release once published, and verify the installed build number post-upgrade.
• Re-validate engineering projects and instrument drivers after upgrade in a staging environment before broad rollout, given LabVIEW's role in production test workflows.

3) Long-term hardening:

• Establish a software supply-chain control for VI artifacts (signing/hashing, internal review) so that manipulated VIs cannot enter engineering pipelines unnoticed.
• Monitor NI security advisories via a subscribed vulnerability-management feed, and track CVE-2026-64202 for KEV/exploit updates.
• Instrument endpoints to alert on LabVIEW process crashes and unexpected child processes, and baseline normal VI-open behavior to reduce detection false positives.
• Adopt fuzzing and file-format validation gates in engineering workflows that consume third-party VIs.

References

• NVD — CVE-2026-64202: https://nvd.nist.gov/vuln/detail/CVE-2026-64202
• CWE-125: Out-of-bounds Read — https://cwe.mitre.org/data/definitions/125.html
• MITRE ATT&CK T1204.002 — User Execution: Malicious File — https://attack.mitre.org/techniques/T1204/002/
• FIRST EPSS — CVE-2026-64202 score lookup: https://api.first.org/data/v1/epss?cve=CVE-2026-64202
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-64202 not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• NI Product Security Advisories portal: https://www.ni.com/en/support/security.html

No public proof-of-concept, exploit code, or Nuclei template is available for CVE-2026-64202, and there is no evidence of exploitation in the wild or attribution to a known threat actor campaign in the provided intelligence.