CVE-2017-2775

An exploitable memory corruption vulnerability exists in the LvVariantUnflatten functionality in 64-bit versions of LabVIEW before 2015 SP1 f7 Patch and 2016…

High · published March 31, 2017

CVSS v3.0
7.5
EPSS
3%
Percentile
86.9
In the wild
Unconfirmed
What it is

An exploitable memory corruption vulnerability exists in the LvVariantUnflatten functionality in 64-bit versions of LabVIEW before 2015 SP1 f7 Patch and 2016 before f2 Patch. A specially crafted VI file can cause a user controlled value to be used as a loop terminator resulting in internal heap corruption. An attacker controlled VI file can be used to trigger this vulnerability, exploitation could lead to remote code execution.

The record
Technical detail
CVSS v3.0
7.5 · HIGH
Vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.02940 · 86.9th percentile
Published
2017-03-31T18:00Z
EPSS history
Timeline
  • 31 MAR 18:00Z
    An exploitable memory corruption vulnerability exists in the LvVariantUnflatten functionality in 64-bit versions of LabVIEW before 2015 SP1 f7 Patch and 2016…
    cvelistv5