High severity · published Sep 5, 2017
CVE-2017-2779
An exploitable memory corruption vulnerability exists in the RSRC segment parsing functionality of LabVIEW 2017, LabVIEW 2016, LabVIEW 2015, and LabVIEW 2014
7.8
CVSS
2.2%
EPSS
No
On KEV
Description
An exploitable memory corruption vulnerability exists in the RSRC segment parsing functionality of LabVIEW 2017, LabVIEW 2016, LabVIEW 2015, and LabVIEW 2014. A specially crafted Virtual Instrument (VI) file can cause an attacker controlled looping condition resulting in an arbitrary null write. An attacker controlled VI file can be used to trigger this vulnerability and can potentially result in code execution.
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.2% · higher than 82% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LA
Labview · NI
2014; 2015; 2016; 2017 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-2779
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-2779
Mitigation
http://www.ni.com/product-documentation/54099/en/
Third Party Advisory
http://www.securityfocus.com/bid/100519
Exploit
https://0patch.blogspot.com/2017/09/0patching-rsrc-arbitrary-null-write.html
Exploit
https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0273
More from Labview
7.8
CVE-2026-64204
Out-of-Bounds Write Vulnerability in NI LabVIEW when loading VI
7.8
CVE-2026-64203
Out-of-Bounds Read Vulnerability in NI LabVIEW when loading VI
7.8
CVE-2026-64202
Out-of-Bounds Read Vulnerability in NI LabVIEW when loading VI
7.8
CVE-2026-64201
Out-of-Bounds Read Vulnerability in NI LabVIEW when loading VI
7.8
CVE-2026-16234
Out-of-Bounds Read Vulnerability in NI LabVIEW when loading VI