There is an integer conversion vulnerability resulting in an out-of-bounds read when loading images recently discovered in NI LabVIEW. This may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted VI file. This vulnerability affects NI LabVIEW 2026 Q3 and prior versions.
This vulnerability is identified as CVE-2026-18444.
NI strongly recommends upgrading the affected software to mitigate these vulnerabilities. Refer to the Affected Products section for information on upgrading these products.
NI Update Service is a Windows utility that checks for and delivers updates for NI software and drivers, including security updates. It can be used to manually check for updates, configured to periodically check and notify users, or to automatically download and install updates at a scheduled time.
Some mitigations in this advisory are delivered through NI Update Service. NI recommends upgrading to NI Update Service 2026 Q3 or later to get the latest updates. NI Update Service can be installed on its own and is backwards compatible with older NI software.
We view the security of our products as an important part of our commitment to our customers. Go to ni.com/security to stay informed and act upon security alerts and issues.
Thank you to Grigory Dorodnov of TrendAI Research for reporting this issue and working with us on coordinated disclosure.
Microsoft and Windows are trademarks of the Microsoft group of companies.
| Product Version | Mitigation |
|---|---|
| LabVIEW 2026 | Upgrade to LabVIEW 2026 Q3 Patch 1 or later from NI Package Manager or Software Downloads or install patch via NI Update Service. |
| LabVIEW 2025 | Upgrade to LabVIEW 2025 Q3 Patch 5 or later from NI Package Manager or Software Downloads or install patch via NI Update Service. |
| LabVIEW 2024 | Upgrade to LabVIEW 2024 Q3 Patch 7 or later from NI Package Manager or Software Downloads or install patch via NI Update Service. |
| LabVIEW 2023 | Upgrade to LabVIEW 2023 Q3 Patch 10 or later from NI Package Manager or Software Downloads or install patch via NI Update Service. |
| LabVIEW 2022 and prior | Not in Mainstream Support |