From 04:00 PM CDT – 08:00 PM CDT (09:00 PM UTC – 01:00 AM UTC) Tuesday, April 16, ni.com will undergo system upgrades that may result in temporary service interruption.

We appreciate your patience as we improve our online experience.

Incomplete RSRC Validation in LabVIEW

Updated Mar 21, 2024

NI has implemented a fix for a crash that can occur in LabVIEW due to incomplete input validation of Virtual Instrument (VI) files. Links to relevant patches are included at the bottom of this page.

Affected Products

LabVIEW 2017
LabVIEW 2016
LabVIEW 2015
LabVIEW 2014

Background

A specially crafted VI file can cause the RSRC segment parsing function in LabVIEW to write an arbitrary number of zeros to memory when the VI file is opened by a user. This could result in memory corruption or a LabVIEW crash.

Memory corruption can be a security vulnerability. In this case, exploitation for code execution is very unlikely (for example, refer to the Common Consequences section of CWE-476) and has not been demonstrated. Exploitation for code execution is further mitigated by the operating system’s memory protections. The vulnerability cannot be exploited remotely because the RSRC segment parsing function is not bound to the network stack.

Mitigation

Always exercise the same precautions with VI files as you would with EXE and DLL files. Refer to Security Best Practices for LabVIEW VI Files for guidelines.

Available Patches

This issue was addressed in the following patches:

Note: Links above refer to the 32-bit Windows LabVIEW Development Environment patches only. Other platforms and bitnesses can be found by searching NI Product Downloads for the relevant patch.

CVSS Score

5.3 - CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H