Out of bounds read in HeapObjMapImpl.cpp in NI LabVIEW
Priority LOW 38CWE-1285Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Active
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
An out of bounds read due to improper input validation in HeapObjMapImpl.cpp in NI LabVIEW may disclose information or result in arbitrary code execution. Successful exploitation requires an attacker to provide a user with a specially crafted VI. This vulnerability affects LabVIEW 2024 Q3 and prior versions.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00193 8th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| NI | LabVIEW | up to 22.3.3; 23.0.0 – 23.3.4; 24.0.0 – 24.3.1 | — | No fix listed | CNA |
- LabVIEW VendorNI Affected up to 22.3.3; 23.0.0 – 23.3.4; 24.0.0 – 24.3.1 Fixed in — No fix listed CNA
CPE configurations NVD · 15
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:ni:labview:*:*:*:*:*:*:*:* | up to 2021 | Vulnerable | NI |
| cpe:2.3:a:ni:labview:2022:q1:*:*:*:*:*:* | 2022 q1 | Vulnerable | NI |
| cpe:2.3:a:ni:labview:2022:q3:*:*:*:*:*:* | 2022 q3 | Vulnerable | NI |
| cpe:2.3:a:ni:labview:2022:q3_patch1:*:*:*:*:*:* | 2022 q3_patch1 | Vulnerable | NI |
| cpe:2.3:a:ni:labview:2022:q3_patch2:*:*:*:*:*:* | 2022 q3_patch2 | Vulnerable | NI |
| cpe:2.3:a:ni:labview:2023:q1:*:*:*:*:*:* | 2023 q1 | Vulnerable | NI |
| cpe:2.3:a:ni:labview:2023:q3:*:*:*:*:*:* | 2023 q3 | Vulnerable | NI |
| cpe:2.3:a:ni:labview:2023:q3_patch1:*:*:*:*:*:* | 2023 q3_patch1 | Vulnerable | NI |
| cpe:2.3:a:ni:labview:2023:q3_patch2:*:*:*:*:*:* | 2023 q3_patch2 | Vulnerable | NI |
| cpe:2.3:a:ni:labview:2023:q3_patch3:*:*:*:*:*:* | 2023 q3_patch3 | Vulnerable | NI |
- cpe:2.3:a:ni:labview:*:*:*:*:*:*:*:* Versions up to 2021 Vulnerable ·NI
- cpe:2.3:a:ni:labview:2022:q1:*:*:*:*:*:* Versions 2022 q1 Vulnerable ·NI
- cpe:2.3:a:ni:labview:2022:q3:*:*:*:*:*:* Versions 2022 q3 Vulnerable ·NI
- cpe:2.3:a:ni:labview:2022:q3_patch1:*:*:*:*:*:* Versions 2022 q3_patch1 Vulnerable ·NI
- cpe:2.3:a:ni:labview:2022:q3_patch2:*:*:*:*:*:* Versions 2022 q3_patch2 Vulnerable ·NI
- cpe:2.3:a:ni:labview:2023:q1:*:*:*:*:*:* Versions 2023 q1 Vulnerable ·NI
- cpe:2.3:a:ni:labview:2023:q3:*:*:*:*:*:* Versions 2023 q3 Vulnerable ·NI
- cpe:2.3:a:ni:labview:2023:q3_patch1:*:*:*:*:*:* Versions 2023 q3_patch1 Vulnerable ·NI
- cpe:2.3:a:ni:labview:2023:q3_patch2:*:*:*:*:*:* Versions 2023 q3_patch2 Vulnerable ·NI
- cpe:2.3:a:ni:labview:2023:q3_patch3:*:*:*:*:*:* Versions 2023 q3_patch3 Vulnerable ·NI
Show 5 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:ni:labview:2023:q3_patch4:*:*:*:*:*:* | 2023 q3_patch4 | Vulnerable | NI |
| cpe:2.3:a:ni:labview:2024:q1:*:*:*:*:*:* | 2024 q1 | Vulnerable | NI |
| cpe:2.3:a:ni:labview:2024:q1_patch1:*:*:*:*:*:* | 2024 q1_patch1 | Vulnerable | NI |
| cpe:2.3:a:ni:labview:2024:q3:*:*:*:*:*:* | 2024 q3 | Vulnerable | NI |
| cpe:2.3:a:ni:labview:2024:q3_patch1:*:*:*:*:*:* | 2024 q3_patch1 | Vulnerable | NI |
- cpe:2.3:a:ni:labview:2023:q3_patch4:*:*:*:*:*:* Versions 2023 q3_patch4 Vulnerable ·NI
- cpe:2.3:a:ni:labview:2024:q1:*:*:*:*:*:* Versions 2024 q1 Vulnerable ·NI
- cpe:2.3:a:ni:labview:2024:q1_patch1:*:*:*:*:*:* Versions 2024 q1_patch1 Vulnerable ·NI
- cpe:2.3:a:ni:labview:2024:q3:*:*:*:*:*:* Versions 2024 q3 Vulnerable ·NI
- cpe:2.3:a:ni:labview:2024:q3_patch1:*:*:*:*:*:* Versions 2024 q3_patch1 Vulnerable ·NI
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2024-10494
- 2026-10-03 Alias added: GHSA-hmrx-44gm-wjp8
- 2026-11-05 Affected versions changed · CNA
References
More NI Labview vulnerabilities
- TI-2025-07172 Missing input check in lvpict.cpp used in NI LabVIEW CVSS 4.0HIGH 8.5
- TI-2013-04391 Absolute path traversal vulnerability in the 3D Graph ActiveX control in cw3dgrph.ocx in… CVSS 2.0HIGH 10.0
- TI-2013-04390 Multiple absolute path traversal vulnerabilities in National Instruments cwui.ocx, as… CVSS 2.0HIGH 9.3
- TI-2025-07173 Memory Corruption Issue in NI LabVIEW due to improper error handling CVSS 4.0HIGH 8.5
- TI-2025-06708 Code Injection Vulnerability in NI LabVIEW when using CIN nodes CVSS 4.0HIGH 8.5
- TI-2017-01999 Memory corruption in National Instruments LabVIEW 2016 Evaluation CVSS 3.0HIGH 7.8
Sources
- CVE-2024-10494 · CVE Program
- CVE-2024-10494 · NVD
- FIRST EPSS
- GHSA-hmrx-44gm-wjp8 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences