Vulnerability details

CVE-2025-2633

NI LabVIEW

Out of Bounds Read Vulnerability in NI LabVIEW when loading fonts

CVSS 4.0

7.3High

Official description

Out of bounds read vulnerability due to improper bounds checking in NI LabVIEW in lvre!UDecStrToNum that may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted VI. This vulnerability affects NI LabVIEW 2025 Q1 and prior versions.

CVSS scores

Score	Version	Source	Vector
7.3High	4.0	CVEProject cvelistV5 (CNA) (NI)	`CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`
7.8High	3.1	CVEProject cvelistV5 (CNA) (NI)	`CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`

Affected products

Vendor	Product	Versions	Source
NI	LabVIEW	v ≤ 22.3.5	CVEProject cvelistV5 (CNA)
NI	LabVIEW	23.0.0 ≤ v ≤ 23.3.6	CVEProject cvelistV5 (CNA)
NI	LabVIEW	24.0.0 ≤ v ≤ 24.3.3	CVEProject cvelistV5 (CNA)
NI	LabVIEW	25.0.0 ≤ v < 25.3.0	CVEProject cvelistV5 (CNA)

References and advisories

https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/out-of-bounds-read-vulnerabilities-in-ni-labview.html

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2025-07-23
Last updated: 2025-07-23
State: Published
Assigner (CNA): NI

Exploit prediction (EPSS)

0.18%

Probability of exploitation in 30 days

8.1%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: None
Technical impact: Total

Weaknesses (CWE)

CWE-1285
Improper Validation of Specified Index, Position, or Offset in Input