NI LabVIEW: Integer Overflow in VI File Parsing Exposes Sensitive Data

The Zero Day Initiative published advisory ZDI-26-630 on September 9, 2026, covering a vulnerability in NI LabVIEW that exploits an integer overflow in VI file parsing to disclose sensitive information. The same flaw is cataloged by the vendor as CVE-2026-18445, with CVSS 3.1 and 4.0 scores of 6.6 and 6.9 respectively. The vector requires a user to open a malicious VI file or visit a compromised web page, making social engineering the linchpin of the attack.

The Overflow Mechanics: What Happens During VI File Parsing

The issue lies in the parsing of VI files, the native format for LabVIEW projects. According to the ZDI advisory, "the specific flaw exists within the parsing of VI files. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before reading from memory." The sequence is precise: malformed data in the file is not validated, generates an overflow in integer arithmetic operations, and this condition leads to attacker-controlled memory reads. The impact is information disclosure: "an attacker can leverage this vulnerability to disclose information in the context of the current process," as ZDI reports. No evidence of remote code execution emerges from the dossier.

The VI file is the fundamental building block of the LabVIEW ecosystem: it contains graphical source code, front panels, and block diagram definitions. It is a proprietary format shared daily among engineers, researchers, and automation technicians. This ubiquity makes the vector particularly insidious in collaborative environments where file exchange is routine.

"This vulnerability allows remote attackers to disclose sensitive information on affected installations of NI LabVIEW. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file." — Advisory ZDI-26-630

Timeline and Discovery: From June to Coordinated Release

The vulnerability was reported to the vendor on June 30, 2026, with coordinated public release on September 9, 2026. The researcher who identified the flaw is Grigory Dorodnov of TrendAI Research, as confirmed by the NI advisory: "Thank you to Grigory Dorodnov of TrendAI Research for reporting this issue and working with us on coordinated disclosure." Coordinated disclosure allowed NI to prepare updates for four product generations before publication.

The roughly two-and-a-half-month window between report and disclosure is standard for coordinated processes of this type. The Zero Day Initiative, TrendAI's vulnerability acquisition program, kept the flaw confidential until vendor fixes were available.

Patches and Affected Versions: The Perimeter of the Attack Surface

The NI advisory identifies CVE-2026-18445 as "identified as CVE-2026-18445" and provides patch and version details. LabVIEW 2026 Q3 and earlier were found vulnerable. NI has released specific updates: LabVIEW 2026 Q3 Patch 1, LabVIEW 2025 Q3 Patch 5, LabVIEW 2024 Q3 Patch 7, and LabVIEW 2023 Q3 Patch 10. Versions 2022 and earlier "are not in Mainstream Support," as the vendor explicitly states: they do not receive patches through the standard maintenance channel.

The CVSS 3.1 score of 6.6 with vector AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H places the vulnerability in the Medium range. The CVSS 4.0 score of 6.9 confirms comparable severity in the new scoring framework. The scores derive exclusively from the NI advisory, not the ZDI text, which does not report quantitative severity metrics. The AV:L (Attack Vector: Local) vector reflects the requirement for user interaction, not a geographic or network limitation.

What to Do Now

For environments using LabVIEW in configurations exposed to file sharing among teams:

• Verify the installed version and apply the specific patches indicated by NI for your release cycle (2026 Q3 Patch 1, 2025 Q3 Patch 5, 2024 Q3 Patch 7, 2023 Q3 Patch 10).
• Evaluate migration from versions 2022 and earlier, which are outside mainstream support and have no patches available for this vulnerability.
• Implement controls on VI file exchange in collaborative settings, recognizing that the format is a documented attack vector.
• Monitor the opening of VI files from unverified sources, given that user interaction is a necessary condition for exploitation.

A Proprietary Format as a Forgotten Security Frontier

VI files embody a structural tension in Industry 4.0: formats designed for functionality and portability whose attack surface remains opaque to end users. An engineer receiving a VI from a colleague does not perceive the parsing risk as they would with an executable or a script. Yet the parser is executable code, with the same validation logic that can fail.

The discrepancy between the ZDI title ("information disclosure") and the NI formulation referencing an "integer overflow vulnerability resulting in an out-of-bounds write" raises a point of attention: the two descriptions may reflect different phases of the same failure chain, or related advisories sharing root cause and CVE identifier. The dossier does not clarify this overlap, which does not affect the need for patching but signals how technical terminology can vary even between converging primary sources.

The specific type of information exposed in the LabVIEW process memory remains undocumented — whether industrial process data, user metadata, or other — and no evidence of public exploits or in-the-wild use has emerged at the time of publication.

Sources

• http://www.zerodayinitiative.com/advisories/ZDI-26-630/
• http://www.zerodayinitiative.com/advisories/published/
• https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/2026/integer-overflow-vulnerability-resulting-in-an-out-of-bounds-write-in-ni-labview.html

Information has been verified against cited sources and updated at time of publication.

Sources