PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-64467 National Instruments CVE debrief

National Instruments LabVIEW contains an out-of-bounds read vulnerability in the LVResFile::FindRsrcListEntry() function that triggers when opening a corrupted VI (Virtual Instrument) file. The vulnerability, published December 18, 2025, carries a CVSS 3.1 score of 7.8 (HIGH severity). Successful exploitation requires user interaction—specifically, convincing a victim to open a maliciously crafted VI file. The impact scope includes potential information disclosure and arbitrary code execution. The vulnerability affects multiple LabVIEW versions, with patches available for supported releases. LabVIEW 2021 is noted as not being in mainstream support and lacks a vendor fix.

Vendor
National Instruments
Product
LabVIEW
CVSS
HIGH 8.5
CISA KEV
Not listed in stored evidence
Original CVE published
2025-12-18
Original CVE updated
2026-09-30
Advisory published
2025-12-18
Advisory updated
2026-09-30

Who should care

Organizations using National Instruments LabVIEW in engineering, test, measurement, and industrial automation environments. This includes manufacturing facilities, research laboratories, aerospace/defense contractors, and academic institutions relying on LabVIEW for data acquisition and control systems. Security teams should prioritize patching due to the high severity rating and potential for code execution in environments where LabVIEW processes may have access to sensitive operational technology networks.

Technical summary

The vulnerability exists in the LVResFile::FindRsrcListEntry() function within LabVIEW's resource file handling code. When processing a corrupted VI file, improper bounds checking leads to an out-of-bounds read condition. This memory safety defect can be leveraged to disclose sensitive information from process memory or achieve arbitrary code execution under the context of the LabVIEW process. The attack requires local access with user interaction (opening a malicious VI), with no privileges required. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates high impacts across confidentiality, integrity, and availability dimensions.

Defensive priority

HIGH

Recommended defensive actions

  • Upgrade LabVIEW 2025 to Q3 Patch 3 or later via NI Package Manager or Software Downloads
  • Upgrade LabVIEW 2024 to Q3 Patch 5 or later via NI Package Manager or Software Downloads
  • Upgrade LabVIEW 2023 to Q3 Patch 8 or later via NI Package Manager or Software Downloads
  • Upgrade LabVIEW 2022 to Q3 Patch 7 or later via NI Package Manager or Software Downloads
  • For LabVIEW 2021, migrate to a supported version as it is no longer in mainstream support
  • Implement user awareness training to reduce risk of social engineering attacks targeting VI file opening
  • Apply defense-in-depth strategies per CISA ICS recommended practices
  • Restrict execution of untrusted VI files through application whitelisting where feasible

Evidence notes

Vulnerability details sourced from CISA CSAF advisory ICSA-25-352-03. CVSS vector confirms local attack vector with user interaction required. Vendor fix URLs provided in CSAF remediations section.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-64467 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-64467

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-64467 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-64467

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-352-03.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-352-03

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/sites/default/files/publications/emailscams0905.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ncas/tips/ST04-014

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.