Vulnerability · Published Dec 10, 2024 · Assigned by NI

CVE-2024-10494Out of bounds read in HeapObjMapImpl.cpp in NI LabVIEW

High 7.8

In plain English

A high-severity security flaw in LabVIEW from NI. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).

Severity (CVSS 3.1)7.8High

Exploit odds (30 days)0.2%top 91.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

An out of bounds read due to improper input validation in HeapObjMapImpl.cpp in NI LabVIEW may disclose information or result in arbitrary code execution. Successful exploitation requires an attacker to provide a user with a specially crafted VI. This vulnerability affects LabVIEW 2024 Q3 and prior versions.

Affected products (as reported)

Vendor	Product	Versions
NI	LabVIEW	0 – through 22.3.323.0.0 – through 23.3.424.0.0 – through 24.3.1

Weakness: CWE-1285 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/out-of-bounds-read-vulnerabilities-in-ni-labview-.html