Out of Bounds Write Vulnerability in NI LabVIEW in InitCPUInformation()
Priority LOW 38CWE-787Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.
Summary
Out of bounds write vulnerability due to improper bounds checking in NI LabVIEW in InitCPUInformation() that may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted VI. This vulnerability affects NI LabVIEW 2025 Q1 and prior versions.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00202 10th percentileScored 2026-11-07
Fix Fixed LabVIEW (NI): 22.3.4, 23.3.5, 24.3.2 +1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| NI | LabVIEW | before 22.3.4; 23.1.0 to before 23.3.5; 24.1.0 to before 24.3.2; 25.1.0 to before 25.1.1 | 22.3.4, 23.3.5, 24.3.2, 25.1.1 | Patch available | CNA |
- LabVIEW VendorNI Affected before 22.3.4; 23.1.0 to before 23.3.5; 24.1.0 to before 24.3.2; 25.1.0 to before 25.1.1 Fixed in 22.3.4, 23.3.5, 24.3.2, 25.1.1 Patch available CNA
CPE configurations NVD · 20
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:ni:labview:*:*:*:*:*:*:*:* | up to 2021 | Vulnerable | NI |
| cpe:2.3:a:ni:labview:2022:q1:*:*:*:*:*:* | 2022 q1 | Vulnerable | NI |
| cpe:2.3:a:ni:labview:2022:q3:*:*:*:*:*:* | 2022 q3 | Vulnerable | NI |
| cpe:2.3:a:ni:labview:2022:q3_patch1:*:*:*:*:*:* | 2022 q3_patch1 | Vulnerable | NI |
| cpe:2.3:a:ni:labview:2022:q3_patch2:*:*:*:*:*:* | 2022 q3_patch2 | Vulnerable | NI |
| cpe:2.3:a:ni:labview:2022:q3_patch4:*:*:*:*:*:* | 2022 q3_patch4 | Vulnerable | NI |
| cpe:2.3:a:ni:labview:2023:q1:*:*:*:*:*:* | 2023 q1 | Vulnerable | NI |
| cpe:2.3:a:ni:labview:2023:q3:*:*:*:*:*:* | 2023 q3 | Vulnerable | NI |
| cpe:2.3:a:ni:labview:2023:q3_patch1:*:*:*:*:*:* | 2023 q3_patch1 | Vulnerable | NI |
| cpe:2.3:a:ni:labview:2023:q3_patch2:*:*:*:*:*:* | 2023 q3_patch2 | Vulnerable | NI |
- cpe:2.3:a:ni:labview:*:*:*:*:*:*:*:* Versions up to 2021 Vulnerable ·NI
- cpe:2.3:a:ni:labview:2022:q1:*:*:*:*:*:* Versions 2022 q1 Vulnerable ·NI
- cpe:2.3:a:ni:labview:2022:q3:*:*:*:*:*:* Versions 2022 q3 Vulnerable ·NI
- cpe:2.3:a:ni:labview:2022:q3_patch1:*:*:*:*:*:* Versions 2022 q3_patch1 Vulnerable ·NI
- cpe:2.3:a:ni:labview:2022:q3_patch2:*:*:*:*:*:* Versions 2022 q3_patch2 Vulnerable ·NI
- cpe:2.3:a:ni:labview:2022:q3_patch4:*:*:*:*:*:* Versions 2022 q3_patch4 Vulnerable ·NI
- cpe:2.3:a:ni:labview:2023:q1:*:*:*:*:*:* Versions 2023 q1 Vulnerable ·NI
- cpe:2.3:a:ni:labview:2023:q3:*:*:*:*:*:* Versions 2023 q3 Vulnerable ·NI
- cpe:2.3:a:ni:labview:2023:q3_patch1:*:*:*:*:*:* Versions 2023 q3_patch1 Vulnerable ·NI
- cpe:2.3:a:ni:labview:2023:q3_patch2:*:*:*:*:*:* Versions 2023 q3_patch2 Vulnerable ·NI
Show 10 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:ni:labview:2023:q3_patch3:*:*:*:*:*:* | 2023 q3_patch3 | Vulnerable | NI |
| cpe:2.3:a:ni:labview:2023:q3_patch4:*:*:*:*:*:* | 2023 q3_patch4 | Vulnerable | NI |
| cpe:2.3:a:ni:labview:2023:q3_patch5:*:*:*:*:*:* | 2023 q3_patch5 | Vulnerable | NI |
| cpe:2.3:a:ni:labview:2024:q1:*:*:*:*:*:* | 2024 q1 | Vulnerable | NI |
| cpe:2.3:a:ni:labview:2024:q1_patch1:*:*:*:*:*:* | 2024 q1_patch1 | Vulnerable | NI |
| cpe:2.3:a:ni:labview:2024:q3:*:*:*:*:*:* | 2024 q3 | Vulnerable | NI |
| cpe:2.3:a:ni:labview:2024:q3_patch1:*:*:*:*:*:* | 2024 q3_patch1 | Vulnerable | NI |
| cpe:2.3:a:ni:labview:2024:q3_patch2:*:*:*:*:*:* | 2024 q3_patch2 | Vulnerable | NI |
| cpe:2.3:a:ni:labview:2025:q1:*:*:*:*:*:* | 2025 q1 | Vulnerable | NI |
| cpe:2.3:a:ni:labview:2025:q1_patch1:*:*:*:*:*:* | 2025 q1_patch1 | Vulnerable | NI |
- cpe:2.3:a:ni:labview:2023:q3_patch3:*:*:*:*:*:* Versions 2023 q3_patch3 Vulnerable ·NI
- cpe:2.3:a:ni:labview:2023:q3_patch4:*:*:*:*:*:* Versions 2023 q3_patch4 Vulnerable ·NI
- cpe:2.3:a:ni:labview:2023:q3_patch5:*:*:*:*:*:* Versions 2023 q3_patch5 Vulnerable ·NI
- cpe:2.3:a:ni:labview:2024:q1:*:*:*:*:*:* Versions 2024 q1 Vulnerable ·NI
- cpe:2.3:a:ni:labview:2024:q1_patch1:*:*:*:*:*:* Versions 2024 q1_patch1 Vulnerable ·NI
- cpe:2.3:a:ni:labview:2024:q3:*:*:*:*:*:* Versions 2024 q3 Vulnerable ·NI
- cpe:2.3:a:ni:labview:2024:q3_patch1:*:*:*:*:*:* Versions 2024 q3_patch1 Vulnerable ·NI
- cpe:2.3:a:ni:labview:2024:q3_patch2:*:*:*:*:*:* Versions 2024 q3_patch2 Vulnerable ·NI
- cpe:2.3:a:ni:labview:2025:q1:*:*:*:*:*:* Versions 2025 q1 Vulnerable ·NI
- cpe:2.3:a:ni:labview:2025:q1_patch1:*:*:*:*:*:* Versions 2025 q1_patch1 Vulnerable ·NI
Remediation
- Fix · CNA LabVIEW (NI) Fixed in 22.3.4, 23.3.5, 24.3.2, 25.1.1
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
NI LabVIEW 22.3.4, 23.3.5 and 2 more versions
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2025-02298 Out of Bounds Write Vulnerability in NI LabVIEW reading CPU info from cachePriority LOW 38
Timeline
- 2026-10-02 Threatist record created from CVE-2025-2631
- 2026-10-03 Alias added: GHSA-grxg-r84x-j5gq
References
More NI Labview vulnerabilities
- TI-2025-07172 Missing input check in lvpict.cpp used in NI LabVIEW CVSS 4.0HIGH 8.5
- TI-2013-04391 Absolute path traversal vulnerability in the 3D Graph ActiveX control in cw3dgrph.ocx in… CVSS 2.0HIGH 10.0
- TI-2013-04390 Multiple absolute path traversal vulnerabilities in National Instruments cwui.ocx, as… CVSS 2.0HIGH 9.3
- TI-2025-07173 Memory Corruption Issue in NI LabVIEW due to improper error handling CVSS 4.0HIGH 8.5
- TI-2025-06708 Code Injection Vulnerability in NI LabVIEW when using CIN nodes CVSS 4.0HIGH 8.5
- TI-2017-01999 Memory corruption in National Instruments LabVIEW 2016 Evaluation CVSS 3.0HIGH 7.8
Sources
- CVE-2025-2631 · CVE Program
- CVE-2025-2631 · NVD
- FIRST EPSS
- GHSA-grxg-r84x-j5gq · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences