CVE-2025-2633Out of Bounds Read Vulnerability in NI LabVIEW when loading fonts

7.3HighCVSS base score
0.18%Exploitation in 30 daysEPSS · top 92% of all CVEs
NoKnown exploitednot in CISA's KEV catalog
NonePublic exploitsnone known yet

Description

Out of bounds read vulnerability due to improper bounds checking in NI LabVIEW in lvre!UDecStrToNum that may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted VI. This vulnerability affects NI LabVIEW 2025 Q1 and prior versions.

Timeline

2025
21 Mar 2025
21 Mar 2025
ID reserved
By NI
23 Jul 20254 months later
23 Jul 2025· 4 months later
Published

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2025-2633, by who scored it
Scored by	CVSS	Score	Vector
NICNA (assigner)	4.0	High7.3	CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
NICNA (assigner)	3.1	High7.8	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVDNVD · Analyzed	4.0	High7.3	CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS (exploitation in 30 days): 0.18% · top 92% of all CVEs (12 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.3.

Affected products

NI · LabVIEW
- affected ≤ 22.3.5
- affected 23.0.0 – ≤ 23.3.6
- affected 24.0.0 – ≤ 24.3.3
- affected 25.0.0 – < 25.3.0

References1

https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/out-of-bounds-read-vulnerabilities-in-ni-labview.html (opens in a new tab)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2025-2633](https://cveledger.app/badge/CVE-2025-2633.svg)](https://cveledger.app/cve/CVE-2025-2633)

Record last updated 23 Jul 2025, 17:23 UTC.