An out of bounds read vulnerability in NI LabVIEW allows for potential information disclosure or arbitrary code execution when a user opens a specially crafted VI file.

The vulnerability is an out of bounds read (CWE-125) triggered within the LVResFile::RGetMemFileHandle() function. Exploitation requires an unauthenticated attacker to convince a user to open a malicious, specially crafted VI file.

The potential for arbitrary code execution poses a severe risk to organizational security, as it allows attackers to gain unauthorized control over affected workstations. With a CVSS score of 7.8, this flaw is categorized as High severity, indicating that successful exploitation could lead to significant data compromise or lateral movement within the production environment.

Immediate Action: Review the official NI security advisory to identify available patches and apply updates to all instances of LabVIEW immediately.

Proactive Monitoring: Monitor endpoint activity for suspicious file handling processes or unexpected crashes of the LabVIEW application that may indicate exploitation attempts.

Compensating Controls: Implement strict email and file transfer filtering policies to prevent users from opening untrusted or unsolicited VI files from unknown sources.

Public Exploit Available: No (exploit_available: false)

Given the potential for arbitrary code execution, this vulnerability represents a significant risk to the integrity of engineering and development systems. Administrators should prioritize identifying all systems running the affected versions of LabVIEW and apply the vendor provided security updates as soon as they are made available to mitigate the risk of compromise.