ZDI-CAN-28516: ZDI-26-291: NI LabVIEW LVCLASS File Parsing Memory Corruption Remote Code Execution Vulnerability

Published Apr 15, 2026

Updated

This vulnerability allows remote attackers to execute arbitrary code on affected installations of NI LabVIEW. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-32861.

Affected Software

1 affected component

National Instruments LabVIEW

Event History

Apr 15, 2026

Advisory Published

via ZDI·05:00 AM

Data Sourced

via ZDI·05:00 AM

Description

Frequently Asked Questions

What is the severity of ZDI-CAN-28516?

The severity of ZDI-CAN-28516 is critical due to its potential for remote code execution.

How do I fix ZDI-CAN-28516?

To fix ZDI-CAN-28516, update to the latest version of NI LabVIEW provided by National Instruments.

What type of vulnerability is ZDI-CAN-28516?

ZDI-CAN-28516 is a memory corruption vulnerability that can lead to remote code execution.

What software is affected by ZDI-CAN-28516?

ZDI-CAN-28516 affects installations of National Instruments LabVIEW.

Does exploiting ZDI-CAN-28516 require user interaction?

Yes, exploiting ZDI-CAN-28516 requires user interaction as the target must visit a malicious file.