A memory corruption vulnerability in NI LabVIEW allows for arbitrary code execution if a user is coerced into opening a specially crafted VI file.

This flaw involves an out-of-bounds read within the sentry_transaction_context_set_operation function, which can be triggered by a local user interacting with a malicious file. The attack vector requires user interaction and does not require prior authentication.

The vulnerability carries a CVSS score of 7.8, indicating a high level of severity. Successful exploitation could lead to full system compromise or unauthorized information disclosure, presenting a significant risk to intellectual property and operational integrity. The requirement for user interaction slightly mitigates the immediate risk, but the impact of code execution remains critical for affected engineering environments.

Immediate Action: Update NI LabVIEW to the latest patched versions as specified in the NI security advisory.

Proactive Monitoring: Monitor system logs for unusual application crashes or process terminations that may indicate failed or successful exploitation attempts.

Compensating Controls: Implement strict file access policies and user training to prevent the opening of untrusted or unexpected VI files from external sources.

Public Exploit Available: Unknown

Given the potential for arbitrary code execution, this vulnerability poses a severe risk to development and production systems running NI LabVIEW. Administrators should prioritize the deployment of vendor-supplied security updates across all affected environments to eliminate the underlying memory corruption flaw.