CVE-2026-32864

OVERVIEW CVE-2026-32864 is a memory corruption vulnerability affecting NI LabVIEW 2026 Q1 (26.1.0) and prior versions. The flaw exists as an out-of-bounds read in the mgcore_SH_25_3!aligned_free() function and can be exploited when a user opens a specially crafted VI file, potentially leading to information disclosure or arbitrary code execution. SEVERITY The vulnerability carries a CVSS 3.1 score of 7.8 (HIGH) with a local attack vector requiring minimal user interaction but no elevated privileges. The attack complexity is low, indicating the exploit is straightforward to execute. The flaw poses high severity across confidentiality, integrity, and availability impacts, making successful exploitation a significant risk for affected organizations. EXPLOITATION STATUS There is currently no evidence of active exploitation in the wild. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog and remains inactive on threat intelligence hotlists. EPSS data indicates minimal prevalence compared to other CVEs, and no public exploit code is currently available, reducing immediate risk but warranting timely patching of affected LabVIEW installations.