Vulnerability · Published Apr 9, 2025 · Assigned by NI

CVE-2025-2629DLL Hijacking Vulnerability in NI LabVIEW When Loading NI Error Reporting

High 7.3

In plain English

A high-severity uncontrolled search path in LabVIEW from NI. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).

Severity (CVSS 3.1)7.3High

Exploit odds (30 days)0.2%top 90.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

There is a DLL hijacking vulnerability due to an uncontrolled search path that exists in NI LabVIEW when loading NI Error Reporting. This vulnerability may result in arbitrary code execution. Successful exploitation requires an attacker to insert a malicious DLL into the uncontrolled search path. This vulnerability affects NI LabVIEW 2025 Q1 and prior versions.

Affected products (as reported)

Vendor	Product	Versions
NI	LabVIEW	0 – before 22.3.423.1.0 – before 223.3.524.1.0 – before 24.3.225.1.0 – before 25.1.1

Weakness: CWE-427 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

References

https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/dll-hijacking-vulnerability-in-ni-labview-when-loading-ni-error-reporting.html