Integer Overflow Vulnerability Resulting in an Out of Bounds Write in NI LabVIEW

Description

There is an integer overflow vulnerability resulting in an out-of-bounds write recently discovered in NI LabVIEW.  This may result in information disclosure or arbitrary code execution.  Successful exploitation requires an attacker to get a user to open a specially crafted VI file.  This vulnerability affects NI LabVIEW 2026 Q3 and prior versions.

Scores

EPSS (exploitation in 30 days)

0.18% · top 92% of all CVEs (5 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.9.

Weakness

• CWE-190 Integer overflow or wraparound (opens in a new tab)All about CWE-190 and its CVEs

Affected products

• NI · LabVIEW

  • affected < 23.0.0
  • affected 23.1.0 – < 23.3.10
  • affected 24.1.0 – < 24.3.7
  • affected 25.1.0 – < 25.3.5
  • affected 26.1.0 – < 26.3.1

References (1)

• https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/2026/integer-overflow-vulnerability-resulting-in-an-out-of-bounds-write-in-ni-labview.html (opens in a new tab)

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-18445](https://trackcve.app/badge/CVE-2026-18445.svg)](https://trackcve.app/cve/CVE-2026-18445)

Record last updated 31 Aug 2026, 15:15 UTC.