Vulnerability details

CVE-2025-2629

NI LabVIEW

DLL Hijacking Vulnerability in NI LabVIEW When Loading NI Error Reporting

CVSS 4.0

7.0High

Official description

There is a DLL hijacking vulnerability due to an uncontrolled search path that exists in NI LabVIEW when loading NI Error Reporting. This vulnerability may result in arbitrary code execution. Successful exploitation requires an attacker to insert a malicious DLL into the uncontrolled search path. This vulnerability affects NI LabVIEW 2025 Q1 and prior versions.

CVSS scores

Score	Version	Source	Vector
7.0High	4.0	CVEProject cvelistV5 (CNA) (NI)	`CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`
7.3High	3.1	CVEProject cvelistV5 (CNA) (NI)	`CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H`

Affected products

Vendor	Product	Versions	Source
NI	LabVIEW	v < 22.3.4	CVEProject cvelistV5 (CNA)
NI	LabVIEW	23.1.0 ≤ v < 223.3.5	CVEProject cvelistV5 (CNA)
NI	LabVIEW	24.1.0 ≤ v < 24.3.2	CVEProject cvelistV5 (CNA)
NI	LabVIEW	25.1.0 ≤ v < 25.1.1	CVEProject cvelistV5 (CNA)

References and advisories

https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/dll-hijacking-vulnerability-in-ni-labview-when-loading-ni-error-reporting.html

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2025-04-09
Last updated: 2025-04-09
State: Published
Assigner (CNA): NI

Exploit prediction (EPSS)

0.19%

Probability of exploitation in 30 days

9.1%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: None
Technical impact: Total

Weaknesses (CWE)

CWE-427
Uncontrolled Search Path Element