ZDI-26-630: NI LabVIEW VI File Parsing Integer Overflow Information Disclosure Vulnerability

Zerodayinitiative • September 9, 2026

This vulnerability allows remote attackers to disclose sensitive information on affected installations of NI LabVIEW. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of VI files. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before reading from memory. An attacker can leverage this vulnerability to disclose information in the context of the current process.

NI has issued an update to correct this vulnerability. More details can be found at:

2026-06-30 - Vulnerability reported to vendor

2026-09-09 - Coordinated public release of advisory

2026-09-09 - Advisory Updated

Grigory Dorodnov of TrendAI Research

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple Vulnerabilities in NI LabVIEW Lead to Potential Code Execution Risks Two critical vulnerabilities have been identified in NI LabVIEW, affecting versions 2026 Q3 and earlier. CVE-2026-18444 involves an integer conversion vulnerability that can lead to an out-of-bounds read, while CVE-2026-18445 pertains to an integer overflow vulnerability causing an out-of-bounds write. Both vulnerabilities require user interaction to exploit, specifically by opening a specially crafted VI file. Successful exploitation may allow attackers to disclose sensitive information or execute arbitrary code. NI has issued advisories recommending users to upgrade their software to mitigate these risks. The vulnerabilities were reported by Grigory Dorodnov of TrendAI Research and have been assigned CVSS scores of 6.6 and 6.9 respectively. The vulnerabilities have been publicly disclosed today, September 9, 2026. 2 sources 46

Extracted Entities

Attack Types (1)

Data Breach

Companies (1)

ZDI-26-630: NI LabVIEW VI File Parsing Integer Overflow Information Disclosure Vulnerability

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CWE Weaknesses (1)

Platforms (1)

Vulnerabilities (1)