A memory corruption vulnerability in NI LabVIEW poses a risk of arbitrary code execution if a user is enticed to open a malicious VI file.

This is a use-after-free vulnerability (CWE-416) within the sentry_span_set_data function. The flaw is triggered when the application parses a corrupted VI file, requiring user interaction to execute the malicious code.

Successful exploitation of this vulnerability could lead to total compromise of the affected system, including arbitrary code execution and potential disclosure of sensitive information. With a CVSS score of 7.8, this vulnerability is considered High severity, as it facilitates significant system-level impact despite the requirement for user interaction.

Immediate Action: Review the official NI security advisory for patch availability and apply all recommended updates to your LabVIEW environment immediately.

Proactive Monitoring: Monitor system logs for unusual application crashes or unexpected spikes in memory usage associated with LabVIEW processes, as these may indicate attempted exploitation.

Compensating Controls: Implement strict file access policies and user training to discourage opening untrusted or unsolicited VI files from external or unknown sources.

Public Exploit Available: Unknown.

Given the potential for arbitrary code execution, this vulnerability represents a significant risk to the integrity and confidentiality of systems running NI LabVIEW. Security teams should prioritize identifying all instances of the affected software within their environment and apply vendor-supplied patches as soon as they become available.