CVE-2024-10494

Out of bounds read in HeapObjMapImpl.cpp in NI LabVIEW

State: Published
Severity: 8.4 High
Published: Dec 10, 2024
Updated: Dec 10, 2024
Reserved: Oct 29, 2024

Description

An out of bounds read due to improper input validation in HeapObjMapImpl.cpp in NI LabVIEW may disclose information or result in arbitrary code execution. Successful exploitation requires an attacker to provide a user with a specially crafted VI. This vulnerability affects LabVIEW 2024 Q3 and prior versions.

Scores

CVSS	Score	Vector	Source
4.0	8.4 High	CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N	NI
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	NI

Weaknesses

CWE-1285 Improper Validation of Specified Index, Position, or Offset in Input

Affected Products

Product	Versions
LabVIEWNI	22.3.3 and earlierAffected 23.0 through 23.3.4Affected 24.0 through 24.3.1Affected

References

https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/out-of-bounds-read-vulnerabilities-in-ni-labview-.html

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.