Back www.ni.com

Integer Overflow Vulnerability Resulting In An Out Of Bounds Write In Ni Labview

www.ni.com • September 9, 2026

There is an integer overflow vulnerability resulting in an out-of-bounds write recently discovered in NI LabVIEW. This may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted VI file. This vulnerability affects NI LabVIEW 2026 Q3 and prior versions.

This vulnerability is identified as CVE-2026-18445 .

NI strongly recommends upgrading the affected software to mitigate these vulnerabilities. Refer to the Affected Products section for information on upgrading these products.

CVE-2026-18445 – 6.6 - CVSS:3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H

CVE-2026-18445 – 6.9 - CVSS:4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N

NI Update Service is a Windows utility that checks for and delivers updates for NI software and drivers, including security updates. It can be used to manually check for updates, configured to periodically check and notify users, or to automatically download and install updates at a scheduled time.

Some mitigations in this advisory are delivered through NI Update Service. We recommend upgrading to NI Update Service 2026 Q3 or later to get the latest updates. NI Update Service can be installed on its own and is backwards compatible with older NI software.

We view the security of our products as an important part of our commitment to our customers. Go to ni.com/security to stay informed and act upon security alerts and issues.

Thank you to Grigory Dorodnov of TrendAI Research for reporting this issue and working with us on coordinated disclosure.

CVE-2026-18445 - National Vulnerability Database

CWE-190 – Integer Overflow

Microsoft and Windows are trademarks of the Microsoft group of companies.

Was this information helpful?

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple Vulnerabilities in NI LabVIEW Lead to Potential Code Execution Risks Two critical vulnerabilities have been identified in NI LabVIEW, affecting versions 2026 Q3 and earlier. CVE-2026-18444 involves an integer conversion vulnerability that can lead to an out-of-bounds read, while CVE-2026-18445 pertains to an integer overflow vulnerability causing an out-of-bounds write. Both vulnerabilities require user interaction to exploit, specifically by opening a specially crafted VI file. Successful exploitation may allow attackers to disclose sensitive information or execute arbitrary code. NI has issued advisories recommending users to upgrade their software to mitigate these risks. The vulnerabilities were reported by Grigory Dorodnov of TrendAI Research and have been assigned CVSS scores of 6.6 and 6.9 respectively. The vulnerabilities have been publicly disclosed today, September 9, 2026. 4 sources 46

Extracted Entities

Attack Types (2)

Data Breach Zero-day Exploit

Companies (1)

Integer Overflow Vulnerability Resulting In An Out Of Bounds Write In Ni Labview

The full story

Extracted Entities

Attack Types (2)

Companies (1)

CVEs (1)

CWE Weaknesses (2)

Domains (2)

MITRE ATT&CK (1)

Platforms (2)