PT-2025-15843 · National Instruments · Ni Labview

Michael Heinzl · Published 2025-04-09 · Updated 2025-08-18 · CVE-2025-2632

Positive Technologies (AI Summary)

CVSS v4.0

8.5

High

Base vector

AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions: NI LabVIEW versions prior to 2025 Q1

Description: The issue is an out of bounds write vulnerability due to improper bounds checking in NI LabVIEW when reading CPU info from cache. This may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted VI.

Recommendations: For versions prior to 2025 Q1, update to a version that includes the fix for this issue to prevent exploitation. As a temporary workaround, consider restricting the execution of specially crafted VIs to minimize the risk of exploitation.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2025-2632

Affected Products

Ni Labview

References · 11

• https://osv.dev/vulnerability/CVE-2025-2632 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-2632 · Security Note
• https://ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/out-of-bounds-write-vulnerabilities-in-ni-labview.html · Vendor Advisory
• https://twitter.com/syedaquib77/status/1912601634062102858 · Twitter Post
• https://t.me/cvetracker/21255 · Telegram Post
• https://t.me/cvedetector/22600 · Telegram Post
• https://t.me/cveNotify/132724 · Telegram Post
• https://twitter.com/CVEnew/status/1910073389961654568 · Twitter Post
• https://twitter.com/cybercronai/status/1910366421491552341 · Twitter Post
• https://twitter.com/CveFindCom/status/1910052895162093871 · Twitter Post
• https://twitter.com/CVETracker/status/1910422719608369249 · Twitter Post