Read the docs
TI-2017-01999 Aliases CVE-2017-2775GHSA-f7q2-f9g4-wwg4

Memory corruption in National Instruments LabVIEW 2016 Evaluation

Priority LOW 39CWE-119Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-119 and the CVSS impact.

Summary

An exploitable memory corruption vulnerability exists in the LvVariantUnflatten functionality in 64-bit versions of LabVIEW before 2015 SP1 f7 Patch and 2016 before f2 Patch. A specially crafted VI file can cause a user controlled value to be used as a loop terminator resulting in internal heap corruption. An attacker controlled VI file can be used to trigger this vulnerability, exploitation could lead to remote code execution.

Why it matters now

EPSS 0.0294 87th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
National InstrumentsLabVIEW 2016 Evaluation16.0.0.49152—No fix listedCNA
  • LabVIEW 2016 Evaluation VendorNational Instruments Affected 16.0.0.49152 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:ni:labview:16.0.0.49152:*:*:*:*:*:*:*16.0.0.49152VulnerableNI
  • cpe:2.3:a:ni:labview:16.0.0.49152:*:*:*:*:*:*:* Versions 16.0.0.49152 Vulnerable ·NI

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-2775
  2. 2026-10-03 Alias added: GHSA-f7q2-f9g4-wwg4

References

Exploit 1

Other 1

  • TI-2008-05128 Stack-based buffer overflow in National Instruments Electronics Workbench allows… CVSS 2.0HIGH 9.3
  • TI-2017-02001 Out-of-bounds write in National Instruments LabVIEW 2016 CVSS 3.0HIGH 7.8
  • TI-2002-00725 LabVIEW Web Server 5.1.1 through 6.1 allows remote attackers to cause a denial of service… CVSS 2.0MEDIUM 5.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences