CVE-2017-2775

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

An exploitable memory corruption vulnerability exists in the LvVariantUnflatten functionality in 64-bit versions of LabVIEW before 2015 SP1 f7 Patch and 2016 before f2 Patch. A specially crafted VI file can cause a user controlled value to be used as a loop terminator resulting in internal heap corruption. An attacker controlled VI file can be used to trigger this vulnerability, exploitation could lead to remote code execution.

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119

Affected software

Vendor	Product	Versions
National Instruments	LabVIEW 2016 Evaluation	16.0.0.49152

References

http://www.ni.com/product-documentation/53778/en/
http://www.securityfocus.com/bid/97020Third Party Advisory, VDB Entry
http://www.talosintelligence.com/reports/TALOS-2017-0269/Exploit, Technical Description, Third Party Advisory, VDB Entry
http://www.ni.com/product-documentation/53778/en/
http://www.securityfocus.com/bid/97020Third Party Advisory, VDB Entry
http://www.talosintelligence.com/reports/TALOS-2017-0269/Exploit, Technical Description, Third Party Advisory, VDB Entry

Timeline

Published: Mar 31, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-27777.8An exploitable heap overflow vulnerability exists in the ipStringCreate function of Iceni Argus Version 6.6.05. A specially crafted pdf file CVE-2017-27797.8An exploitable memory corruption vulnerability exists in the RSRC segment parsing functionality of LabVIEW 2017, LabVIEW 2016, LabVIEW 2015,CVE-2017-27809.8An exploitable heap buffer overflow vulnerability exists in the X509 certificate parsing functionality of InsideSecure MatrixSSL 3.8.7b. A s CVE-2017-27819.8An exploitable heap buffer overflow vulnerability exists in the X509 certificate parsing functionality of InsideSecure MatrixSSL 3.8.7b. A s CVE-2017-27829.1An integer overflow vulnerability exists in the X509 certificate parsing functionality of InsideSecure MatrixSSL 3.8.7b. A specially crafted CVE-2017-27837.8An exploitable heap corruption vulnerability exists in the FillRowFormat functionality of Antenna House DMC HTMLFilter that is shipped with CVE-2017-27848.1An exploitable free of a stack pointer vulnerability exists in the x509 certificate parsing code of ARM mbed TLS before 1.3.19, 2.x before 2 CVE-2017-278510.0An exploitable buffer overflow exists in the psnotifyd application of the Pharos PopUp printer client version 9.0. A specially crafted packe CVE-2017-27867.5A denial of service vulnerability exists in the psnotifyd application of the Pharos PopUp printer client version 9.0. A specially crafted pa CVE-2017-27879.0A buffer overflows exists in the psnotifyd application of the Pharos PopUp printer client version 9.0. A specially crafted packet can be sen CVE-2017-278810.0A buffer overflows exists in the psnotifyd application of the Pharos PopUp printer client version 9.0. A specially crafted packet can be sen CVE-2017-27899.8When copying filedata into a buffer, JustSystems Ichitaro Office 2016 Trial will calculate two values to determine how much data to copy fro