CVE-2017-2779

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

An exploitable memory corruption vulnerability exists in the RSRC segment parsing functionality of LabVIEW 2017, LabVIEW 2016, LabVIEW 2015, and LabVIEW 2014. A specially crafted Virtual Instrument (VI) file can cause an attacker controlled looping condition resulting in an arbitrary null write. An attacker controlled VI file can be used to trigger this vulnerability and can potentially result in code execution.

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
National Instruments	LabVIEW 2016	16.0

References

http://www.ni.com/product-documentation/54099/en/Mitigation, Vendor Advisory
http://www.securityfocus.com/bid/100519Third Party Advisory, VDB Entry
https://0patch.blogspot.com/2017/09/0patching-rsrc-arbitrary-null-write.htmlExploit, Patch, Third Party Advisory
https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0273Exploit, Third Party Advisory, VDB Entry
http://www.ni.com/product-documentation/54099/en/Mitigation, Vendor Advisory
http://www.securityfocus.com/bid/100519Third Party Advisory, VDB Entry
https://0patch.blogspot.com/2017/09/0patching-rsrc-arbitrary-null-write.htmlExploit, Patch, Third Party Advisory
https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0273Exploit, Third Party Advisory, VDB Entry

Timeline

Published: Sep 5, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-27809.8An exploitable heap buffer overflow vulnerability exists in the X509 certificate parsing functionality of InsideSecure MatrixSSL 3.8.7b. A s CVE-2017-27819.8An exploitable heap buffer overflow vulnerability exists in the X509 certificate parsing functionality of InsideSecure MatrixSSL 3.8.7b. A s CVE-2017-27829.1An integer overflow vulnerability exists in the X509 certificate parsing functionality of InsideSecure MatrixSSL 3.8.7b. A specially crafted CVE-2017-27837.8An exploitable heap corruption vulnerability exists in the FillRowFormat functionality of Antenna House DMC HTMLFilter that is shipped with CVE-2017-27848.1An exploitable free of a stack pointer vulnerability exists in the x509 certificate parsing code of ARM mbed TLS before 1.3.19, 2.x before 2 CVE-2017-278510.0An exploitable buffer overflow exists in the psnotifyd application of the Pharos PopUp printer client version 9.0. A specially crafted packe CVE-2017-27867.5A denial of service vulnerability exists in the psnotifyd application of the Pharos PopUp printer client version 9.0. A specially crafted pa CVE-2017-27879.0A buffer overflows exists in the psnotifyd application of the Pharos PopUp printer client version 9.0. A specially crafted packet can be sen CVE-2017-278810.0A buffer overflows exists in the psnotifyd application of the Pharos PopUp printer client version 9.0. A specially crafted packet can be sen CVE-2017-27899.8When copying filedata into a buffer, JustSystems Ichitaro Office 2016 Trial will calculate two values to determine how much data to copy fro CVE-2017-27909.8When processing a record type of 0x3c from a Workbook stream from an Excel file (.xls), JustSystems Ichitaro Office trusts that the size is CVE-2017-27917.8JustSystems Ichitaro 2016 Trial contains a vulnerability that exists when trying to open a specially crafted PowerPoint file. Due to the app