CVE-2026-18445 is a medium severity (CVSS 3.1 6.6) integer overflow in NI LabVIEW 2026 Q3 and prior versions. A crafted VI file can cause an out-of-bounds write, with information disclosure or code execution possible. NI fixes it in 2026 Q3 Patch 1, 2025 Q3 Patch 5, 2024 Q3 Patch 7 and 2023 Q3 Patch 10.
What's affected
NI's advisory lists LabVIEW 2026 Q3 and prior versions as affected. Fixed versions:
- LabVIEW 2026: 2026 Q3 Patch 1 or later
- LabVIEW 2025: 2025 Q3 Patch 5 or later
- LabVIEW 2024: 2024 Q3 Patch 7 or later
- LabVIEW 2023: 2023 Q3 Patch 10 or later
- LabVIEW 2022 and earlier: not in Mainstream Support, with no fix listed
NI gives a CVSS 4.0 score of 6.9 in addition to the 3.1 score of 6.6 in the record. This CVE is a sibling of CVE-2026-18444, an out-of-bounds read in the same product, fixed by the same patch levels.
How to check if you're exposed
Read the installed LabVIEW version and patch level from NI Package Manager, then compare it with the fixed versions above. Check lab computers and test benches as well as developer desktops.
For files, find the places VI files enter your organization: email, shared project folders, vendor example code and downloads from forums. Anyone opening files from those sources on an unpatched machine is the exposed group.
If your endpoint tooling can list installed software, filter for LabVIEW and sort by version to find the machines that still need a patch.
What to do now
- List every LabVIEW installation and its patch level.
- Apply the fixed patch for your major version using NI Package Manager, NI Software Downloads or NI Update Service.
- Install NI Update Service 2026 Q3 or later, because some mitigations arrive through it.
- Plan an upgrade for installs on 2022 or earlier.
- Treat VI files from outside the organization as untrusted until you have patched.
- Patch the sibling CVE-2026-18444 in the same change.
Why it matters
The weakness class is CWE-190, integer overflow or wraparound. When a calculation of a size overflows, the result is smaller than expected. Code that then allocates a buffer from that number and writes the full data into it overruns the buffer. This is a classic route from a malformed file to memory corruption.
A write is more serious than a read because it can change program state. NI still rates the whole issue medium because the attacker has to get a user to open a file on the local machine. The KEV flag is false, and NI does not state that it is exploited.
Quick check
Is this the same as CVE-2026-18444?
No. They are two separate flaws in the same product, a write and a read, fixed by the same patch levels.
Do I need to worry if nobody opens outside files?
The risk is lower, but files do arrive by email and shared folders. Patching is still the safer choice.
Sources
Last reviewed: 18 October 2026.
