TI-2025-05451 Aliases CVE-2025-6033 GHSA-whc9-qqp7-r44w

Memory Corruption issue in XML_Serialize() in NI Circuit Design Suite

LOW 38CWE-787Published 2025-09-30 · Updated 2026-02-26

Key facts

Attack vector: Local
Privileges required: None
User interaction: Passive
Attack complexity: Low
Attack requirements: None
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.

Summary

There is a memory corruption vulnerability due to an out of bounds write in XML_Serialize() when using SymbolEditor in NI Circuit Design Suite. This vulnerability may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted .sym file. This vulnerability affects NI Circuit Design Suite 14.3.1 and prior versions.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00183 7th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
NI	Circuit Design Suite	up to 14.3.1	—	No fix listed	CNA

Circuit Design Suite VendorNI Affected up to 14.3.1 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:ni:circuit_design_suite::::::::	before 14.3.2	Vulnerable	NI

cpe:2.3:a:ni:circuit_design_suite:*:*:*:*:*:*:*:* Versions before 14.3.2 Vulnerable ·NI

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2025-6033
2026-10-03 Alias added: GHSA-whc9-qqp7-r44w

References

Advisory 1

https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/improper-input-validation-causes-memory-corruption-vulnerabilities-in-circuit-design-suite.html

TI-2025-21722 Stack-based Buffer Overflow in DrObjectStorage::XML_Serialize() in NI Circuit Design Suite CVSS 4.0HIGH 8.5
TI-2025-21721 Out of Bounds Read in Bitmap::InternalDraw() in NI Circuit Design Suite CVSS 4.0HIGH 8.5
TI-2025-21720 Out of Bounds Read in GetSymbolBorderRectSize() in NI Circuit Design Suite CVSS 4.0HIGH 8.5
TI-2025-21719 Out of Bounds Write in CheckPins() in NI Circuit Design Suite CVSS 4.0HIGH 8.5
TI-2025-21718 Out of Bounds Write in Library!DecodeBase64() in NI Circuit Design Suite CVSS 4.0HIGH 8.5
TI-2025-05452 Out of Bounds Read in DefaultFontOptions() in NI Circuit Design Suite CVSS 4.0HIGH 8.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences