CVE-2024-4080 is a high severity memory corruption flaw in the tdcore.dll component of NI LabVIEW. NVD scores it 7.8. It affects LabVIEW 2024 Q1 and prior versions and needs a user to open a crafted VI file. Apply the update on the NI security page.
What's affected
The record lists NI LabVIEW 2024 Q1 and all prior versions, with specific entries for LabVIEW 2021 and 2021 SP1 in the product list. Exploitation needs a user to open a specially crafted VI file, so this is a local file based attack that begins with a delivery step such as email or a shared drive. NVD gives the vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
The record does not give a fixed version. It points to an NI security page titled for this issue, which we did not fetch for this draft. Check that page for the patch or the LabVIEW release that includes it.
Weakness class: CWE-787 (out-of-bounds write).
How to check if you're exposed
Open LabVIEW and choose Help, then About LabVIEW to read the version. On Windows you can also list installed NI software with the NI Package Manager, or from a terminal:
wmic product where "name like '%LabVIEW%'" get name,version
Any LabVIEW at 2024 Q1 or earlier is in scope. Also find shared drives and repositories where VI files are collected, since those are the delivery path.
What to do now
- Inventory LabVIEW installs on engineering workstations, build machines and lab computers.
- Open the NI security page named in the record and apply the patch or upgrade it lists.
- Do not open VI files from unknown sources. Treat files from email and downloads as untrusted until scanned.
- Keep VI files received from outside in a separate review folder and open them on a machine with no sensitive access first.
- Limit the rights of the accounts that run LabVIEW. Day to day work should not need administrator rights.
Why it matters
An improper length check means the code accepts a size from the file without confirming it fits the space set aside, so data can be written past the end of a buffer. The record calls this memory corruption in tdcore.dll that may disclose information or result in arbitrary code execution.
This is an out of bounds write, which is generally more serious than a read because it can change what the program does next.
NI published this CVE together with a sibling entry, CVE-2024-4081, on the same security page. If you patch for one, confirm the update covers both. The record does not say this is exploited in the wild and the KEV flag is false.
Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan and a Gold directory of vulnerability pages for software you already track.
Quick check
Do I have to open a file to be affected?
Yes. The record says successful exploitation requires an attacker to provide a user with a specially crafted VI.
Where is the fixed version?
The record does not state it. Use the NI security page listed in the references.
Sources
These are the references listed in the record. We did not fetch them for this draft, so the version and fix details above come from the record alone and the advisory should be checked.
Last reviewed: 19 October 2026.
