CVE-2017-2775 Memory corruption in LabVIEW 2016 Evaluation

What is CVE-2017-2775?

CVE-2017-2775 is a high-severity memory corruption vulnerability in National Instruments LabVIEW 2016 Evaluation, published on 31 Mar 2017. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

An exploitable memory corruption vulnerability exists in the LvVariantUnflatten functionality in 64-bit versions of LabVIEW before 2015 SP1 f7 Patch and 2016 before f2 Patch. A specially crafted VI file can cause a user controlled value to be used as a loop terminator resulting in internal heap corruption. An attacker controlled VI file can be used to trigger this vulnerability, exploitation could lead to remote code execution.

Weakness: CWE-119

Which versions are affected by CVE-2017-2775?

It affects 1 product.

Products include Ni Labview.

How do I fix CVE-2017-2775?

No fix has been published for CVE-2017-2775 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2017-2775 being exploited?

There is no known exploitation of CVE-2017-2775 in the wild and no public exploit code.

Other vulnerabilities in National Instruments LabVIEW 2016 Evaluation

• CVE-2013-5022 Path traversal in n/a Critical 10.0
• CVE-2026-16233 Out-of-Bounds Write Vulnerability in NI LabVIEW when loading VI High 8.5
• CVE-2026-16234 Out-of-Bounds Read Vulnerability in NI LabVIEW when loading VI High 8.5
• CVE-2026-64201 Out-of-Bounds Read Vulnerability in NI LabVIEW when loading VI High 8.5
• CVE-2026-64202 Out-of-Bounds Read Vulnerability in NI LabVIEW when loading VI High 8.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-f7q2-f9g4-wwg4.