CVE-2017-2779: national instruments labview 2016 Out-of-bounds Write
Vulnerability summary
CVE-2017-2779 is a high (CVSS 7.8) Out-of-bounds Write vulnerability in national instruments labview 2016. EPSS estimates a 2.17% chance of exploitation in the next 30 days, higher than 82.1% of scored vulnerabilities. 2 public exploits are recorded.
Timeline
- 05-09-2017PublishedVulnerability first disclosed.
- 16-09-2024Last modifiedVulnerability information updated.
Description
An exploitable memory corruption vulnerability exists in the RSRC segment parsing functionality of LabVIEW 2017, LabVIEW 2016, LabVIEW 2015, and LabVIEW 2014. A specially crafted Virtual Instrument (VI) file can cause an attacker controlled looping condition resulting in an arbitrary null write. An attacker controlled VI file can be used to trigger this vulnerability and can potentially result in code execution.
CVSS metrics
3 scores · 2 sources · 2 versions- CVE.orgCNA7.5HighCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:HDiffers
EPSS trend
Probability
2.17%
Chance of exploitation in the next 30 days
Percentile
82%
Versus all other CVEs
30-day change
No change 0.00 pp
From 2.17% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
2 foundExploit Reference (0patch.blogspot.com)
Maturity: unknown
Exploit Reference (talosintelligence.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
National instruments1 product
- labview 201616.0
Ni1 product
- labview2014 | 2015 | 2016 | 2017
2 vendors · 2 products
References
4 links- 0patch.blogspot.com/2017/09/0patching-rsrc-arbitrary-null-write.htmlX Refsource MISCExploitPatchThird Party Advisory
- www.talosintelligence.com/vulnerability_reports/TALOS-2017-0273X Refsource MISCExploitThird Party AdvisoryVDB Entry