CVE-2026-32860

CVE-2026-32860 is a memory corruption vulnerability in NI LabVIEW caused by an out-of-bounds write condition when processing corrupted LVLIB files. The vulnerability affects LabVIEW 2026 Q1 (26.1.0) and all prior versions, potentially allowing attackers to achieve information disclosure or arbitrary code execution. The vulnerability carries a CVSS 3.1 score of 7.8 (HIGH) with a local attack vector, low attack complexity, and no privilege requirements. However, successful exploitation requires user interaction, specifically convincing a user to open a malicious .lvlib file. If exploited, the vulnerability could compromise system confidentiality, integrity, and availability. There is currently no evidence of active exploitation in the wild. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog, remains inactive on threat tracking lists, and has minimal community attention based on its exceptionally low EPSS score of 0.0002. Organizations should prioritize patching based on LabVIEW deployment scope rather than immediate threat response.