CVE-2017-2775

HIGH

LabVIEW 2016 Evaluation < 16.0.0.49152 - Memory Corruption via LvVariantUnflatten

Title source: llm

Description

An exploitable memory corruption vulnerability exists in the LvVariantUnflatten functionality in 64-bit versions of LabVIEW before 2015 SP1 f7 Patch and 2016 before f2 Patch. A specially crafted VI file can cause a user controlled value to be used as a loop terminator resulting in internal heap corruption. An attacker controlled VI file can be used to trigger this vulnerability, exploitation could lead to remote code execution.

References (3)

Core 3

Core References

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/97020

Exploit, Technical Description, Third Party Advisory, VDB Entry x_refsource_misc

http://www.talosintelligence.com/reports/TALOS-2017-0269/

Various Sources x_refsource_confirm

http://www.ni.com/product-documentation/53778/en/

Scores

CVSS v3 7.5

EPSS 0.0294

EPSS Percentile 85.4%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE

CWE-119

Status published

Products (2)

National Instruments/LabVIEW 2016 Evaluation 16.0.0.49152

ni/labview 16.0.0.49152

Published Mar 31, 2017

Tracked Since Feb 18, 2026