Overview

The cybersecurity landscape is a constantly evolving battlefield. The latest vulnerability to emerge is CVE-2025-7361, a code injection vulnerability that exists in National Instruments’ LabVIEW software. This vulnerability, if exploited, can result in arbitrary code execution, potentially leading to system compromise or data leakage. The vulnerability affects users of 32-bit NI LabVIEW 2025 Q1 and prior versions. It’s noteworthy that this vulnerability is significant as it can potentially affect a large number of systems as LabVIEW is a widely used system-design platform and development environment for a visual programming language from National Instruments.

Vulnerability Summary

CVE ID: CVE-2025-7361
Severity: High (7.8 CVSS score)
Attack Vector: Local
Privileges Required: Low
User Interaction: Required
Impact: Potential system compromise or data leakage

Affected Products

Product | Affected Versions

NI LabVIEW 32-bit | 2025 Q1 and prior versions

How the Exploit Works

This vulnerability exists due to an improper initialization check in NI LabVIEW. A successful exploit requires an attacker to get a user to open a specially crafted VI (Virtual Instrument) using a CIN (Code Interface Node) node. CIN nodes are used in LabVIEW for calling text-based code from text-based programming languages. Once the specially crafted VI is opened, it can lead to arbitrary code execution, potentially compromising the system or leading to data leakage.

Conceptual Example Code

The following pseudocode provides a conceptual example of how the vulnerability might be exploited:

// Create a new CIN node
CINNode cinNode = new CINNode();
// Load the malicious code to be injected
String maliciousCode = loadMaliciousCode();
// Craft a new VI using the malicious CIN node
VirtualInstrument vi = new VirtualInstrument(cinNode);
// Set the CIN node's code to the malicious code
cinNode.setCode(maliciousCode);
// Open the maliciously crafted VI
vi.open();

This pseudocode illustrates the process of creating a CIN node, loading malicious code, crafting a new VI using the malicious CIN node, setting the CIN node’s code to the malicious code, and then opening the maliciously crafted VI.
In this scenario, the `loadMaliciousCode()` function represents the method the attacker would use to load the malicious code that they wish to inject into the target system.