A critical code injection vulnerability in 32-bit NI LabVIEW could allow an attacker to achieve arbitrary code execution by tricking a user into opening a malicious file.

This is a code injection vulnerability (CWE-94) triggered by an improper initialization check in the Code Interface Node (CIN). Successful exploitation requires an unauthenticated attacker to convince a user to open a specially crafted VI file.

Successful exploitation results in arbitrary code execution on the host machine, potentially leading to a full system compromise, data theft, or the installation of persistent malware. With a CVSS score of 7.8, this vulnerability is considered high severity due to the potential for total loss of system integrity and availability. The requirement for user interaction limits the attack vector, but the impact remains significant for engineering and industrial environments relying on LabVIEW.

Immediate Action: Update 32-bit NI LabVIEW to the latest patched version as specified in the NI security advisory. Organizations should transition to 64-bit LabVIEW versions where possible, as these are not affected by this specific vulnerability.

Proactive Monitoring: Monitor workstation logs for unexpected process execution or abnormal file access patterns initiated by LabVIEW. Users should be cautioned against opening untrusted or unsolicited VI files from external sources.

Compensating Controls: Implement strict file integrity controls and endpoint protection to block the execution of unauthorized or suspicious binaries. Ensure that LabVIEW is run with the minimum necessary privileges to restrict the impact of potential code execution.

Public Exploit Available: No (exploit_available: false)

Given the high potential impact of arbitrary code execution, it is imperative that administrators identify all 32-bit LabVIEW installations and prioritize the application of the vendor-supplied security updates. If patching is not immediately feasible, restrict the ability of users to open files from untrusted sources and evaluate the feasibility of migrating to a 64-bit environment to eliminate the attack surface entirely.