CVE-2025-64463
📋 TL;DR
An out-of-bounds read vulnerability in NI LabVIEW's LVResource::DetachResource() function when parsing corrupted VI files could lead to information disclosure or arbitrary code execution. Attackers must trick users into opening specially crafted VI files. This affects NI LabVIEW 2025 Q3 (25.3) and all prior versions.
💻 Affected Systems
- NI LabVIEW
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Arbitrary code execution with the privileges of the LabVIEW user, potentially leading to full system compromise.
Likely Case
Information disclosure through memory leaks or application crashes when users open malicious VI files.
If Mitigated
Limited impact if users only open trusted VI files from verified sources.
🎯 Exploit Status
Exploitation requires user interaction to open malicious VI files. No public exploit code is currently available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: NI LabVIEW 2025 Q4 (25.4) or later
Restart Required: Yes
Instructions:
1. Download NI LabVIEW 2025 Q4 (25.4) or later from NI website
2. Run the installer with administrative privileges
3. Follow installation prompts
4. Restart the system after installation completes
🔧 Temporary Workarounds
Restrict VI file execution
allConfigure LabVIEW to only open VI files from trusted locations or require user confirmation for all VI files.
User awareness training
allTrain users to only open VI files from trusted sources and verify file integrity before opening.
🧯 If You Can't Patch
- Implement application whitelisting to restrict execution of LabVIEW to trusted locations only.
- Use endpoint protection software configured to detect and block malicious VI files.
🔍 How to Verify
Check if Vulnerable:
Check LabVIEW version via Help > About LabVIEW. If version is 25.3 or earlier, the system is vulnerable.Check Version:
On Windows: "C:\Program Files\National Instruments\LabVIEW 2025\LabVIEW.exe" /versionVerify Fix Applied:
Verify LabVIEW version is 25.4 or later via Help > About LabVIEW after patching.📡 Detection & Monitoring
Log Indicators:
- LabVIEW crash logs with memory access violations
- Unexpected LabVIEW process termination events
Network Indicators:
- Unusual outbound connections from LabVIEW process after opening VI files
SIEM Query:
source="labview.log" AND (event="crash" OR event="access_violation")