Critical Security Update
To help protect your systems, customers using NI driver software 2026 Q2 or earlier should visit ni.com/ni-pal-update and follow the recommended actions.
This page provides information about published security advisories for NI software in 2026. Click the link in the Info Code column to obtain more information or to download the update.
| Name | Type | Description | Info Code |
|---|---|---|---|
| NI Security Update for CVE-2025-14847 | Software | MongoDB Inc. publicly disclosed a new vulnerability on December 19, 2025. This vulnerability is identified as CVE-2025-14847 and commonly referred to as MongoBleed. The high severity vulnerability is an unauthenticated memory read issue which may allow attackers to read uninitialized heap memory remotely. Some NI products use MongoDB and may be affected by this vulnerability. | CVE-2025-14847 |
| Name | Type | Description | Info Code |
|---|---|---|---|
| NI Security Update for CVE-2026-0954 and CVE-2026-0957 | Software | There are two out-of-bounds write vulnerabilities when parsing user files in Digilent DASYLab that may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted DASYLab file. These vulnerabilities affect all versions of Digilent DASYLab. | CVE-2026-0954 CVE-2026-0957 |
| NI Security Update for CVE-2026-0955 and CVE-2026-0956 | Software | There are two out-of-bounds read vulnerabilities when parsing user files in Digilent DASYLab that may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted DASYLab file. These vulnerabilities affect all versions of Digilent DASYLab. | CVE-2026-0955 CVE-2026-0956 |
| NI Security Update for CVE-2026-32860 | Software | There is a file parsing memory corruption vulnerability due to an out-of-bounds write recently discovered in NI LabVIEW that may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted project library (.lvlib) file. This vulnerability affects NI LabVIEW 2026 Q1 and prior versions. | CVE-2026-32860 |
| NI Security Update for CVE-2026-32861 | Software | There is a file parsing memory corruption vulnerability due to an out-of-bounds write recently discovered in NI LabVIEW that may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted LV class (.lvclass) file. This vulnerability affects NI LabVIEW 2026 Q1 and prior versions. | CVE-2026-32861 |
| NI Security Update for CVE-2026-32862, CVE-2026-32863, and CVE-2026-32864 | Software | There are three memory corruption vulnerabilities recently discovered in NI LabVIEW that may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted VI. These vulnerabilities affect NI LabVIEW 2026 Q1 and prior versions. | CVE-2026-32862 CVE-2026-32863 CVE-2026-32864 |
| Name | Type | Description | Info Code |
|---|---|---|---|
| NI Security Update for CVE-2026-9051 | Software | There is an authentication bypass vulnerability in the SystemLink Enterprise Dashboard application. This vulnerability may allow an unauthenticated remote attacker to bypass authentication controls leading to privilege escalation or information disclosure. Privilege escalation is limited to Dashboard resources exclusively. Successful exploitation requires an attacker to send a specially crafted HTTP request. This vulnerability affects NI SystemLink Enterprise 2026-04 and prior versions. | CVE-2026-9051 |
| Name | Type | Description | Info Code |
|---|---|---|---|
| NI Security Update for CVE-2026-8035 and CVE-2026-8036 | Software | There are two invalid input validation vulnerabilities recently discovered in NI-PAL. These vulnerabilities affect NI-PAL 26.3.0 and prior versions on Windows, Linux, and Linux Real-Time. | |
| NI Security Update for CVE-2026-48137, CVE-2026-48138, CVE-2026-48139, CVE-2026-48140, CVE-2026-48141, CVE-2026-9142, and CVE-2026-9143 | Software | There are seven new vulnerabilities recently disclosed in NI gRPC Device Server. These vulnerabilities affect NI gRPC Device Server 2.17.0 and prior versions. | CVE-2026-48137 |
| Name | Type | Description | Info Code |
|---|---|---|---|
| NI Security Update for CVE-2025-21265 | Hardware | Microsoft 2011 Secure Boot Certificates expire June 2026. Once the certificates expire, a device is no longer able to get updates for the Windows Boot Manager and the Secure Boot components. Devices not using Secure Boot will continue to operate and receive normal Windows Updates. | CVE-2025-21265 |
| Name | Type | Description | Info Code |
|---|---|---|---|
| NI Security Update for CVE-2026-18485 | Software | There is a local privilege escalation vulnerability recently discovered in the NI-PAL kernel driver. This may allow a local, authenticated user to escalate privileges and execute arbitrary code. This vulnerability affects NI-PAL 26.3.1 and prior versions running on Microsoft Windows. | CVE-2026-18485 |
| NI Security Update for CVE-2026-18444 | Software | There is an integer conversion vulnerability resulting in an out-of-bounds read when loading images recently discovered in NI LabVIEW. This may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted VI file. This vulnerability affects NI LabVIEW 2026 Q3 and prior versions. | CVE-2026-18444 |
| NI Security Update for CVE-2026-18445 | Software | There is an integer overflow vulnerability resulting in an out-of-bounds write recently discovered in NI LabVIEW. This may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted VI file. This vulnerability affects NI LabVIEW 2026 Q3 and prior versions. | CVE-2026-18445 |
| NI Security Update for CVE-2026-16233, CVE-2026-16234, CVE-2026-64201, CVE-2026-64202, CVE-2026-64203, and CVE-2026-64204 | Software | There are six memory corruption vulnerabilities recently discovered in NI LabVIEW that may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted VI. These vulnerabilities affect NI LabVIEW 2026 Q3 (26.3.0) and prior versions. | CVE-2026-16233
|
| Name | Type | Description | Info Code |
|---|---|---|---|
| NI Security Update for CVE-2026-4129 | Software | There is an improper access control vulnerability in NI SystemLink that may allow an authenticated user with limited privileges to access host operating system files and directories that should be restricted. This vulnerability affects NI SystemLink and NI SystemLink Server versions prior to 2026 Q3. | |
| NI Security Update for CVE-2026-4130 | Software | There is a storage of sensitive information in cleartext vulnerability in NI SystemLink. This vulnerability may allow an attacker with local access to obtain sensitive information stored by the system in the clear. This vulnerability affects NI SystemLink and NI SystemLink Server versions prior to 2026 Q3. | |
| NI Security Update for CVE-2026-19477 | Software | There is stack-based buffer overflow vulnerability recently discovered in MCC Universal Library for Linux (uldaq). This may result in information disclosure or arbitrary code execution. This vulnerability affects MCC Universal Library for Linux (uldaq) v1.2.1 and prior versions. | CVE-2026-19477 |