CVE-2024-4079 is a high severity out of bounds read in NI LabVIEW. NVD scores it 7.8. It affects LabVIEW 2024 Q1 and prior versions and needs a user to open a crafted VI file. Apply the update on the NI security page and avoid untrusted VI files until you have.
What's affected
The record lists NI LabVIEW 2024 Q1 and all prior versions, with specific entries for LabVIEW 2021 and 2021 SP1 in the product list. Exploitation needs a user to open a specially crafted VI file, so this is a local file based attack that begins with a delivery step such as email or a shared drive. NVD gives the vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
The record does not give a fixed version. It points to an NI security page titled for this issue, which we did not fetch for this draft. Check that page for the patch or the LabVIEW release that includes it.
Weakness class: CWE-125 (out-of-bounds read).
How to check if you're exposed
Open LabVIEW and choose Help, then About LabVIEW to read the version. On Windows you can also list installed NI software with the NI Package Manager, or from a terminal:
wmic product where "name like '%LabVIEW%'" get name,version
Any LabVIEW at 2024 Q1 or earlier is in scope. Also find shared drives and repositories where VI files are collected, since those are the delivery path.
What to do now
- Inventory LabVIEW installs on engineering workstations, build machines and lab computers.
- Open the NI security page named in the record and apply the patch or upgrade it lists.
- Do not open VI files from unknown sources. Treat files from email and downloads as untrusted until scanned.
- Keep VI files received from outside in a separate review folder and open them on a machine with no sensitive access first.
- Limit the rights of the accounts that run LabVIEW. Day to day work should not need administrator rights.
Why it matters
An out of bounds read happens when software reads past the end of a buffer because a length or index check is missing. Here the record says a missing bounds check in LabVIEW may disclose information or lead to arbitrary code execution.
The read itself leaks memory contents. With the right layout, a read can also be a step toward running code, which is why NVD scores confidentiality, integrity and availability impact all as high.
Engineering tools are easy to overlook in vulnerability programs because they sit outside the normal IT inventory. They often run on powerful workstations next to lab equipment. Add them to the same asset list as everything else. The record does not say this is exploited in the wild and the KEV flag is false.
Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan and a Gold directory of vulnerability pages for software you already track.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Do I have to open a file to be affected?
Yes. The record says successful exploitation requires an attacker to provide a user with a specially crafted VI.
Where is the fixed version?
The record does not state it. Use the NI security page listed in the references.
Sources
These are the references listed in the record. We did not fetch them for this draft, so the version and fix details above come from the record alone and the advisory should be checked.
Last reviewed: 19 October 2026.
