PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-64465 National Instruments CVE debrief

National Instruments LabVIEW contains an out-of-bounds read vulnerability in the lvre!DataSizeTDR() function that triggers when opening a corrupted Virtual Instrument (VI) file. The vulnerability, published December 18, 2025, carries a CVSS 3.1 score of 7.8 (HIGH severity). Successful exploitation requires user interaction—specifically, convincing a target to open a maliciously crafted VI file. The impact scope includes potential information disclosure and arbitrary code execution. CISA issued advisory ICSA-25-352-03 to coordinate disclosure. National Instruments has released patched versions for supported LabVIEW releases (2022 through 2025), while LabVIEW 2021 is no longer in mainstream support and does not receive fixes.

Vendor
National Instruments
Product
LabVIEW
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2025-12-18
Original CVE updated
2025-12-18
Advisory published
2025-12-18
Advisory updated
2025-12-18

Who should care

Organizations using National Instruments LabVIEW for test, measurement, and control applications, particularly in industrial and research environments where VI files may be shared between users or obtained from external sources. Security teams in OT/ICS environments should prioritize patching due to potential for code execution in engineering workstations.

Technical summary

The vulnerability exists in the lvre!DataSizeTDR() function within LabVIEW's runtime engine. When processing a corrupted VI file, improper bounds checking leads to an out-of-bounds read condition. This memory safety defect can be leveraged to disclose sensitive information from process memory or achieve arbitrary code execution under the context of the LabVIEW process. The attack requires local access with user interaction (opening a malicious file), but no privileges are required to trigger the vulnerability.

Defensive priority

HIGH

Recommended defensive actions

  • Upgrade LabVIEW 2025 installations to Q3 Patch 3 or later
  • Upgrade LabVIEW 2024 installations to Q3 Patch 5 or later
  • Upgrade LabVIEW 2023 installations to Q3 Patch 8 or later
  • Upgrade LabVIEW 2022 installations to Q3 Patch 7 or later
  • Migrate from LabVIEW 2021 to a supported release version as it is no longer in mainstream support
  • Implement application whitelisting to restrict execution of untrusted VI files
  • Train users to recognize and avoid opening VI files from untrusted sources
  • Apply principle of least privilege to LabVIEW processes to limit impact of potential exploitation

Evidence notes

Vulnerability details sourced from CISA CSAF advisory ICSA-25-352-03. CVSS vector confirms local attack vector with user interaction required. Vendor fix information explicitly lists patch versions per supported release year.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-64465 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-64465

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-64465 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-64465

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-352-03.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-352-03

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/sites/default/files/publications/emailscams0905.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ncas/tips/ST04-014

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.