What’s Vulnerable › Vulnerabilities

CVE-2026-32864: Out-of-Bounds Read in mgcore_SH_25_3!aligned_free()

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-04-07 · updated 2026-07-24
• Weakness: CWE-125

Description

There is a memory corruption vulnerability due to an out-of-bounds read in mgcore_SH_25_3!aligned_free() in NI LabVIEW.  This vulnerability may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted VI file. This vulnerability affects NI LabVIEW 2026 Q1 (26.1.0) and prior versions.

Affected products

• NI LabVIEW: through 2022; 2023-q1, 2023-q3, 2023-q3_patch1, 2023-q3_patch2, 2023-q3_patch3, 2023-q3_patch4 (+22)

References

• https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/2026/memory-corruption-vulnerabilities-in-ni-labview.html

Get alerted when CVE-2026-32864 or the next vulnerability affects your stack