Skip to content
NewA calmer, faster ZeroHour
StoryAdvisorylow

ZDI publishes two NI LabVIEW VI file parsing information disclosure advisories: ZDI-26-631 (CVE-2026-18444) and ZDI-26-630 (CVE-2026-18445)

1 source · 2 articlesFirst reported Updated ()2 · 1 read
What's new

First merged summary for this story; no previous summary existed. The merge combines two separately published ZDI advisories (ZDI-26-631 and ZDI-26-630) into a single story covering both NI LabVIEW VI file parsing information disclosure vulnerabilities disclosed on 2026-09-09. No new developments beyond the advisory publications are reported.

Merged summary · glm-5.3-flash · rewritten as coverage arrivesSummaries by Vani AI

On 2026-09-09, the Zero Day Initiative published two advisories for NI LabVIEW VI file parsing vulnerabilities that can disclose sensitive information: an out-of-bounds read tracked as CVE-2026-18444 (ZDI-26-631) and an integer overflow tracked as…

The Zero Day Initiative published two advisories on 2026-09-09 describing vulnerabilities in NI LabVIEW's parsing of VI files. Advisory ZDI-26-631 describes an out-of-bounds read vulnerability assigned CVE-2026-18444. Advisory ZDI-26-630 describes an integer overflow vulnerability assigned CVE-2026-18445. In both cases, exploitation can disclose sensitive information and requires user interaction, such as visiting a malicious page or opening a malicious file. ZDI assigned both flaws a CVSS rating of 3.3. The reports do not state affected LabVIEW versions, patched versions, or fixes, and no source disagreements exist between the two advisories.

Key facts
  • Advisory ZDI-26-631 (published 2026-09-09T05:00:00Z) covers an out-of-bounds read in NI LabVIEW's parsing of VI files, tracked as CVE-2026-18444.
  • Advisory ZDI-26-630 (published 2026-09-09T05:00:00Z) covers an integer overflow in NI LabVIEW's parsing of VI files, tracked as CVE-2026-18445.
  • Both vulnerabilities can disclose sensitive information (information disclosure impact).
  • Exploitation of both vulnerabilities requires user interaction, such as visiting a malicious page or opening a malicious file.
  • ZDI assigned both flaws a CVSS rating of 3.3.
  • The reports do not specify affected LabVIEW versions, patched versions, or vendor fixes.
Analyze CVE-2026-18444 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2026-18444CVE-2026-18445
Vendors
NIZero Day Initiative
Products
NI LabVIEW

Coverage

oldest first · one row per article · UTC
  1. · Sep 9, 2026 ZDI Published AdvisoriesFirst report

    ZDI-26-631: NI LabVIEW VI File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

    ZDI disclosed CVE-2026-18444, an out-of-bounds read in NI LabVIEW VI file parsing that can disclose sensitive information, rated CVSS 3.3.

  2. · Sep 9, 2026 ZDI Published Advisories

    ZDI-26-630: NI LabVIEW VI File Parsing Integer Overflow Information Disclosure Vulnerability

    ZDI disclosed CVE-2026-18445, an integer overflow in NI LabVIEW VI file parsing that can disclose sensitive information, rated CVSS 3.3.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-18444
+1 related CVE
CVE-2026-18445
Out-of-Bounds Read in NI LabVIEW Image Loading Enables Code Execution via Crafted VI
6.9<1%