National Instruments LabVIEW buffer overflow enables local code execution
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Buffer overflow in LabVIEW 2025 Q1 and prior allows local attackers to execute arbitrary code; no active exploitation reported.
National Instruments has disclosed two buffer overflow vulnerabilities (CVE-2025-2633 and CVE-2025-2634) affecting LabVIEW versions 2025 Q1 and prior (CVE-2025-2633) and 2024 Q3 and prior (CVE-2025-2634). Both vulnerabilities stem from improper restriction of operations within memory buffer bounds (CWE-119) and carry CVSS v3.1 scores of 7.8. These are local-attack vulnerabilities requiring user interaction; attackers cannot exploit them remotely. Successful exploitation allows an attacker to disclose sensitive information and execute arbitrary code, resulting in invalid memory reads and potential system compromise.
LabVIEW is widely deployed in critical manufacturing environments worldwide. CISA reports no known public exploitation of these vulnerabilities at this time. National Instruments has released patches for both CVEs. Organizations should prioritize patching and implement network isolation measures to reduce attack surface. The vulnerabilities require local access and user interaction, limiting the immediate threat to insider threats or compromised endpoints with LabVIEW installed.
Mentioned in this report
Detection guidance
LabVIEW Process Spawning Command Interpreter or Script Host
Detects the LabVIEW development environment spawning a shell, script host or common LOLBin, a likely post-exploitation pattern after a malicious VI or file triggers a memory-corruption flaw such as CVE-2025-2633 or CVE-2025-2634. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: LabVIEW Process Spawning Command Interpreter or Script Host
id: a830d901-7878-5b42-863f-d5f4d06f53d2
status: experimental
description: Detects LabVIEW.exe spawning cmd, PowerShell, script hosts or common
LOLBins. After exploitation of a LabVIEW buffer overflow (for example CVE-2025-2633
or CVE-2025-2634) via a crafted file opened by a user, injected code commonly launches
a shell or downloader. The rule keys on the parent/child relation, not on any specific
payload. Legitimate VIs can call System Exec, so tune per environment.
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-210-01
tags:
- attack.execution
- attack.t1203
- attack.t1059
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- \LabVIEW.exe
- \LabVIEWCLI.exe
selection_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \rundll32.exe
- \regsvr32.exe
- \certutil.exe
- \bitsadmin.exe
- \msiexec.exe
condition: selection_parent and selection_child
falsepositives:
- LabVIEW VIs that legitimately call System Exec to run batch files or helper commands
in test and automation setups
- NI installers or add-in tooling launched from LabVIEW that invoke msiexec or cmd
level: medium
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-210-01
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,853 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs