Overview
The cybersecurity landscape is a constantly evolving battlefield. The latest vulnerability to emerge is CVE-2025-7361, a code injection vulnerability that exists in National Instruments’ LabVIEW software. This vulnerability, if exploited, can result in arbitrary code execution, potentially leading to system compromise or data leakage. The vulnerability affects users of 32-bit NI LabVIEW 2025 Q1 and prior versions. It’s noteworthy that this vulnerability is significant as it can potentially affect a large number of systems as LabVIEW is a widely used system-design platform and development environment for a visual programming language from National Instruments.
Vulnerability Summary
CVE ID: CVE-2025-7361
Severity: High (7.8 CVSS score)
Attack Vector: Local
Privileges Required: Low
User Interaction: Required
Impact: Potential system compromise or data leakage
Affected Products
Share secrets securely
Ameeba is private infrastructure for communication and sensitive work built on encrypted identity instead of exposed corporate identity systems.
Passwords, credentials, confidential files, screenshots, internal discussions, sensitive AI context, and private coordination should not become exposed across ordinary communication platforms.
- • Encrypted identity
- • Private Spaces for organizations and teams
- • End-to-end encrypted chat, calls, files, and notes
- • Sensitive AI work and protected collaboration
- • Built for information that cannot leak
Our mission is to secure human work alongside AI.
Product | Affected Versions
NI LabVIEW 32-bit | 2025 Q1 and prior versions
How the Exploit Works
This vulnerability exists due to an improper initialization check in NI LabVIEW. A successful exploit requires an attacker to get a user to open a specially crafted VI (Virtual Instrument) using a CIN (Code Interface Node) node. CIN nodes are used in LabVIEW for calling text-based code from text-based programming languages. Once the specially crafted VI is opened, it can lead to arbitrary code execution, potentially compromising the system or leading to data leakage.
Conceptual Example Code
The following pseudocode provides a conceptual example of how the vulnerability might be exploited:
// Create a new CIN node
CINNode cinNode = new CINNode();
// Load the malicious code to be injected
String maliciousCode = loadMaliciousCode();
// Craft a new VI using the malicious CIN node
VirtualInstrument vi = new VirtualInstrument(cinNode);
// Set the CIN node's code to the malicious code
cinNode.setCode(maliciousCode);
// Open the maliciously crafted VI
vi.open();This pseudocode illustrates the process of creating a CIN node, loading malicious code, crafting a new VI using the malicious CIN node, setting the CIN node’s code to the malicious code, and then opening the maliciously crafted VI.
In this scenario, the `loadMaliciousCode()` function represents the method the attacker would use to load the malicious code that they wish to inject into the target system.