CVE-2026-64203

Executive Summary

CVE-2026-64203 is an out-of-bounds read (CWE-125) memory corruption vulnerability in NI LabVIEW that can lead to information disclosure or arbitrary code execution. Exploitation requires user interaction: a victim must open a specially crafted Virtual Instrument (VI) file. It affects NI LabVIEW 2026 Q3 (26.3.0) and all prior versions, carrying a CVSS base score of 7.8 (High).

Technical Analysis

The vulnerability is classified as CWE-125 (Out-of-bounds Read) and is described by the vendor as a memory corruption issue. In LabVIEW, the VI file format is a structured binary container holding the graphical block diagram, compiled code, front panel data, and metadata. When LabVIEW parses a VI during file open, the application trusts length, offset, and index fields embedded in the file structure to locate and read internal data regions. When such a field is not properly validated against the bounds of the allocated buffer or the actual file size, a read past the end of the buffer can occur. This class of flaw is commonly a precursor to more severe memory corruption, which is consistent with the reported potential for both information disclosure (memory contents returned or leaked) and arbitrary code execution (control-flow hijack when out-of-bounds data is consumed as a pointer, size, or function reference).

The attack surface is the file-open/parse path of the LabVIEW development environment and, by extension, any component that renders or processes VI files. The high confidentiality and integrity subscores (C:H/I:H) are consistent with the possibility that the out-of-bounds read can be chained into disclosure of in-process memory or into code execution. The vulnerability is local in nature (AV:L) with user interaction required (UI:R), meaning the attacker must deliver a malicious VI to a target and convince the user to open it. No authentication is required (PR:N) and exploitation complexity is low (AC:L) once the file is delivered.

Insufficient technical detail is available in the provided intelligence to identify the specific parser component, function, or offset field involved; the description characterizes the flaw only at the vulnerability-class level (memory corruption / out-of-bounds read). No specific internal symbols, file structure fields, or API names beyond "VI" are disclosed.

Exploitation Scenarios

1. Reconnaissance and target identification. An adversary identifies environments where LabVIEW is used — engineering, test-and-measurement, industrial control, and R&D workstations — and where users routinely exchange VI files (shared project directories, email attachments, collaboration platforms, repositories).

2. Delivery. The attacker creates a specially crafted VI file that induces an out-of-bounds read during parsing in a vulnerable LabVIEW version (2026 Q3/26.3.0 or earlier). The file is delivered via phishing email attachment, a shared drive, a code/project repository, or a supply-chain style distribution of a "sample" or "library" VI. No public exploit code is confirmed in the provided data.

3. Trigger. The user opens the crafted VI in LabVIEW, satisfying the UI:R precondition. Parsing of the malformed VI structure causes a read beyond the bounds of an allocated buffer.

4. Payload/execution method. At the vulnerability-class level, the out-of-bounds read yields one of two outcomes: disclosure of adjacent process memory to the attacker's controlled output, or — if the read result is used in a subsequent memory operation — corruption enabling controlled execution within the LabVIEW process context, resulting in arbitrary code execution under the victim's privileges.

5. Post-exploitation impact. Because LabVIEW typically runs with the user's privileges and often resides on engineering workstations with access to source code, test fixtures, and connected instrumentation, successful exploitation can expose sensitive project data (information disclosure) or grant code execution in the user's context (integrity impact), potentially enabling lateral movement or manipulation of connected lab/industrial assets.

No public PoC is identified in the provided data; the attack chain is inferred from the vulnerability class (out-of-bounds read in a file parser) and the stated preconditions.

Impact Assessment

The CVSS v3.1 base score is 7.8 (High) with vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. Impact subscores are high for both confidentiality and integrity, reflecting the dual outcome of information disclosure and arbitrary code execution. Availability is scored High as well (A:H) in the vector, consistent with potential process crash or corruption. Scope is unchanged (S:U), meaning exploitation is contained within the LabVIEW application context.

Affected systems are workstations and engineering endpoints running NI LabVIEW 2026 Q3 (26.3.0) and prior versions. The blast radius includes any organization relying on LabVIEW for test, measurement, automation, or research workflows, where VI files are commonly shared. EPSS is 0.00188 (7.5th percentile), indicating low predicted near-term exploitation activity; CISA KEV status is NO, and no exploit code is confirmed. Business impact centers on loss of proprietary engineering data, integrity of measurement/test results, and potential compromise of hosts that interface with physical hardware and control systems.

Detection Guidance

Sigma Rule

title: Suspicious NI LabVIEW Process Spawning Child Shells or Scripts
id: 9e2f1c44-3b7a-4c1d-8a52-6f0b2d9c7f10
status: experimental
description: Detects LabVIEW spawning shells or script interpreters, which may indicate post-exploitation activity following CVE-2026-64203 memory corruption.
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\LabVIEW.exe'
      - '\LabVIEWCE.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate LabVIEW automation invoking scripts via configured workflows
level: high
tags:
  - attack.t1204.002
  - cve.2026.64203

YARA Rule

rule CVE_2026_64203_LabVIEW_VI_Anomaly
{
    meta:
        author = "Threat Intelligence"
        description = "Heuristic detection of anomalous/oversized VI files potentially abusing CVE-2026-64203 out-of-bounds read in NI LabVIEW"
        reference = "CVE-2026-64203"
        date = "2026-01-01"
    strings:
        $vi_magic = { 4C 56 5A 46 }        // "LVZF" placeholder VI-family signature
        $rsrc     = "LVSR" ascii wide
        $vers     = "LabVIEW" ascii wide
    condition:
        uint32be(0) == 0x4C 46 5A 46 or
        (any of ($rsrc, $vers) and filesize > 5MB)
}

Suricata IDS Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-64203 Potential NI LabVIEW VI File Transfer (SMB/HTTP)"; flow:established,to_server; content:"|4C 56 5A 46|"; depth:2048; classtype:attempted-user; reference:cve,2026-64203; sid:2026642030; rev:1;)

Elastic Detection

process where event.type == "start" and
  process.parent.name in ("LabVIEW.exe", "LabVIEWCE.exe") and
  process.name in ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe")

Splunk SPL Query

index=windows EventCode=1
  (ParentImage="*\\LabVIEW.exe" OR ParentImage="*\\LabVIEWCE.exe")
  (Image="*\\cmd.exe" OR Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\wscript.exe" OR Image="*\\cscript.exe" OR Image="*\\mshta.exe" OR Image="*\\rundll32.exe")
| table _time, host, User, ParentImage, Image, CommandLine

Wazuh OSSEC Rule

<group name="windows,sysmon,cve-2026-64203,">
  <rule id="100403" level="12">
    <if_sid>61603</if_sid>
    <field name="win.eventdata.parentImage">LabVIEW\.exe$|LabVIEWCE\.exe$</field>
    <field name="win.eventdata.image">cmd\.exe$|powershell\.exe$|pwsh\.exe$|wscript\.exe$|cscript\.exe$|mshta\.exe$|rundll32\.exe$</field>
    <description>CVE-2026-64203: NI LabVIEW spawned a script/shell interpreter, possible post-exploitation activity</description>
    <mitre><id>T1204.002</id></mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 2/4 (CLAIMED — a single source, NVD, indicates a fix; vendor advisory and fixed version are not independently confirmed). Treat the following as interim guidance until NI publishes an official advisory.

1. Immediate mitigations:

   • Do not open VI files from untrusted or unsolicited sources; enforce email and web filtering of VI attachments.
   • Restrict inbound distribution of VI files to vetted, signed, or internally controlled sources.
   • Apply least privilege to accounts running LabVIEW and limit host access to engineering workstations.
   • Monitor process-creation telemetry for LabVIEW spawning shells or script interpreters (see Detection Guidance).

2. Patch/upgrade steps:

   • Check the NI security advisory portal and NVD entry (CVE-2026-64203) for an officially confirmed fixed version.
   • Once a vendor fix is confirmed, upgrade LabVIEW to the patched release and validate that parsing of trusted VI files continues to work.
   • Because the fix is only a single-source claim, verify the release notes reference CVE-2026-64203 before relying on the patch for closure.

3. Long-term hardening:

   • Isolate LabVIEW workstations on segmented networks away from general corporate assets and control systems.
   • Implement application allow-listing and controlled file open policies.
   • Maintain an SBOM/inventory of LabVIEW deployments and versions to rapidly identify exposure.
   • Continually monitor the vendor advisory feed and re-evaluate patch confidence as corroborating sources appear.

References

• NVD — CVE-2026-64203: https://nvd.nist.gov/vuln/detail/CVE-2026-64203
• CWE-125 (Out-of-bounds Read): https://cwe.mitre.org/data/definitions/125.html
• NI Security Advisory portal: https://www.ni.com/en/support/security/security-advisories.html
• CISA Known Exploited Vulnerabilities catalog (status: not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• FIRST EPSS: https://www.first.org/epss

No threat actor campaigns or exploit-in-the-wild evidence are identified in the provided data; CISA KEV status is NO, no public exploit code is confirmed, and EPSS is low (0.00188).