TI-2017-02001 Aliases CVE-2017-2779 GHSA-53vp-wxjp-8gw8

Out-of-bounds write in National Instruments LabVIEW 2016

LOW 38CWE-787Published 2017-09-05 · Updated 2024-09-16

Key facts

Attack vector: Local
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.

Summary

An exploitable memory corruption vulnerability exists in the RSRC segment parsing functionality of LabVIEW 2017, LabVIEW 2016, LabVIEW 2015, and LabVIEW 2014. A specially crafted Virtual Instrument (VI) file can cause an attacker controlled looping condition resulting in an arbitrary null write. An attacker controlled VI file can be used to trigger this vulnerability and can potentially result in code execution.

Why it matters now

EPSS 0.02168 82nd percentileScored 2026-11-07

Public exploit Yes 2 exploit referencesTagged by NVD

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
National Instruments	LabVIEW 2016	16.0	—	No fix listed	CNA

LabVIEW 2016 VendorNational Instruments Affected 16.0 Fixed in — No fix listed CNA

CPE configurations NVD · 4

CPE	Versions	Role	Vendor
cpe:2.3:a:ni:labview:2014:::::::*	2014	Vulnerable	NI
cpe:2.3:a:ni:labview:2015:::::::*	2015	Vulnerable	NI
cpe:2.3:a:ni:labview:2016:::::::*	2016	Vulnerable	NI
cpe:2.3:a:ni:labview:2017:::::::*	2017	Vulnerable	NI

cpe:2.3:a:ni:labview:2014:*:*:*:*:*:*:* Versions 2014 Vulnerable ·NI
cpe:2.3:a:ni:labview:2015:*:*:*:*:*:*:* Versions 2015 Vulnerable ·NI
cpe:2.3:a:ni:labview:2016:*:*:*:*:*:*:* Versions 2016 Vulnerable ·NI
cpe:2.3:a:ni:labview:2017:*:*:*:*:*:*:* Versions 2017 Vulnerable ·NI

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2017-2779
2026-10-03 Alias added: GHSA-53vp-wxjp-8gw8

References

Exploit 2

Advisory 1

http://www.ni.com/product-documentation/54099/en/

TI-2008-05128 Stack-based buffer overflow in National Instruments Electronics Workbench allows… CVSS 2.0HIGH 9.3
TI-2017-01999 Memory corruption in National Instruments LabVIEW 2016 Evaluation CVSS 3.0HIGH 7.8
TI-2002-00725 LabVIEW Web Server 5.1.1 through 6.1 allows remote attackers to cause a denial of service… CVSS 2.0MEDIUM 5.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences