CVE-2026-18444: Integer Conversion Vulnerability Resulting in an Out of Bounds Read in NI LabVIEW

Vulnerability summary

CVE-2026-18444 is a high (CVSS 7.8) Signed to Unsigned Conversion Error vulnerability in ni labview. EPSS estimates a 0.13% chance of exploitation in the next 30 days, higher than 2.4% of scored vulnerabilities.

Timeline

1. 25-08-2026
   PublishedVulnerability first disclosed.
2. 31-08-2026
   Last modifiedVulnerability information updated.

Description

There is an integer conversion vulnerability resulting in an out-of-bounds read when loading images recently discovered in NI LabVIEW.  This may result in information disclosure or arbitrary code execution.  Successful exploitation requires an attacker to get a user to open a specially crafted VI file.  This vulnerability affects NI LabVIEW 2026 Q3 and prior versions.

• CWE-195Signed to Unsigned Conversion ErrorThe product uses a signed primitive and performs a cast to an unsigned primitive, which can produce an unexpected value if the value of the signed primitive can not be represented using an unsigned primitive.