Use-After-Free Vulnerability in NI LabVIEW from National Instruments
CVE-2025-64468

8.5HIGH

Key Information:

Vendor

Ni

Status
Labview
Vendor
CVE Published:
18 December 2025

What is CVE-2025-64468?

A use-after-free vulnerability exists in the function sentry!sentry_span_set_data() within NI LabVIEW when it processes a specially crafted VI file. This flaw could potentially allow attackers to exploit the system, leading to information disclosure or arbitrary code execution. To be successful, an attacker must trick the user into opening a malicious VI file. The vulnerability affects NI LabVIEW version 2025 Q3 (25.3) and older versions, highlighting the need for immediate patching and mitigation measures.

Affected Version(s)

LabVIEW 0 <= 22.3.6

LabVIEW 23.1.0 <= 23.3.7

LabVIEW 24.1.0 <= 24.3.4

References

https://www.ni.com/en/support/security/available-critical...

CVSS V4

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Michael Heinzl working with CISA
JSON
.
CVE-2025-64468 : Use-After-Free Vulnerability in NI LabVIEW from National Instruments