CVE-2025-2632

Out of Bounds Write Vulnerability in NI LabVIEW reading CPU info from cache

High8.5EPSS 0.20%

Published: 9 Apr 2025
Updated: 9 Apr 2025
Reserved: 21 Mar 2025
Assigned by: NI

Description

Out of bounds write vulnerability due to improper bounds checking in NI LabVIEW reading CPU info from cache that may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted VI. This vulnerability affects NI LabVIEW 2025 Q1 and prior versions.

Scores

CVSS scores of CVE-2025-2632, by who scored it
Scored by	CVSS	Score	Vector
NICNA (assigner)	4.0	High8.5	CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
NICNA (assigner)	3.1	High7.8	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVDNVD · Analyzed	4.0	High8.5	CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS (exploitation in 30 days): 0.20% · top 90% of all CVEs (6 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.5.

Weakness

CWE-787 Out-of-bounds Write (opens in a new tab)All about CWE-787 and its CVEs

Affected products

NI · LabVIEW
- affected < 22.3.4
- affected 23.1.0 – < 23.3.5
- affected 24.1.0 – < 24.3.2
- affected 25.1.0 – < 25.1.1

References (1)

https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/out-of-bounds-write-vulnerabilities-in-ni-labview.html (opens in a new tab)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2025-2632](https://trackcve.app/badge/CVE-2025-2632.svg)](https://trackcve.app/cve/CVE-2025-2632)

Record last updated 9 Apr 2025, 19:32 UTC.