CVE-2026-18444 is a medium severity (CVSS 3.1 6.6) integer conversion flaw in NI LabVIEW 2026 Q3 and prior versions. Opening a crafted VI file can cause an out-of-bounds read, leading to information disclosure or code execution. NI fixes it in 2026 Q3 Patch 1, 2025 Q3 Patch 5, 2024 Q3 Patch 7 and 2023 Q3 Patch 10.
What's affected
NI's advisory says LabVIEW 2026 Q3 and prior versions are affected. The fixed versions are:
- LabVIEW 2026: 2026 Q3 Patch 1 or later
- LabVIEW 2025: 2025 Q3 Patch 5 or later
- LabVIEW 2024: 2024 Q3 Patch 7 or later
- LabVIEW 2023: 2023 Q3 Patch 10 or later
- LabVIEW 2022 and earlier: not in Mainstream Support, and no fix is listed
NI also publishes a CVSS 4.0 score of 6.9 next to the 3.1 score of 6.6 that appears in the record. Both are medium. The advisory page carries a separate notice about NI driver software 2026 Q2 and earlier, which is not part of this CVE.
How to check if you're exposed
Open NI Package Manager and look at the installed LabVIEW version and patch level, or use the Help menu in LabVIEW to read the version information. Compare it with the fixed versions above.
If you manage engineering workstations at scale, ask for an inventory from your software management tool and filter for LabVIEW. Include test benches and lab machines that are rarely updated, as they often hold older releases.
Also find out where VI files come from. The attack needs a user to open a crafted file, so files received by email, shared drives or vendor downloads are the path to watch.
What to do now
- Inventory LabVIEW installations, including lab and test benches.
- Install the patch for your version through NI Package Manager, NI Software Downloads or NI Update Service.
- Use NI Update Service 2026 Q3 or later, which NI recommends, and which works with older NI software.
- Plan an upgrade for any LabVIEW 2022 or older install, since no fix is listed for it.
- Do not open VI files from untrusted sources until patched.
- Tell engineers that VI files should be treated like executable content.
Why it matters
The weakness class is CWE-195, a signed to unsigned conversion error. A number that is valid as a signed value is converted to an unsigned one, and a negative value becomes a very large size or index. When the image loading code then uses it to read memory, the read goes beyond the intended buffer.
The local attack vector and the need for user interaction hold the score at medium. Still, engineering files move between people and companies all the time, and an attacker needs only one person to open one file. NI does not report exploitation and the KEV flag is false.
Quick check
Does this need network access?
No. The attack vector is local and requires a user to open a crafted VI file.
What if I am on LabVIEW 2022?
NI lists no fix for versions outside Mainstream Support, so plan an upgrade to a supported release.
Sources
Last reviewed: 18 October 2026.
