CVE-2024-12740

HighCVSS 7.8/10Last modified Nov 11, 2026

Description

Vision-related software from NI used a third-party library for image processing that exposes several vulnerabilities. These vulnerabilities may result in arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted file.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
NI	Vision Development Module	<= 24.1
NI	FlexRIO	< 25.0
NI	NI-IMAQdx	<= 23.1
NI	Vision Acquisition Software	<= 23.1
NI	Vision Builder for Automated Inspection	<= 23.*
NI	Data Record AD	<= 2.0
NI	FRC Game Tools	<= 25.0

References

https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/dependency-on-vulnerable-third-party-component-exposes-vulnerabi.html

Timeline

Published: Jan 27, 2025
Last modified: Nov 11, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-127417.8A deserialization of untrusted data vulnerability exists in NI DAQExpress that may result in remote code execution. Successful exploitation CVE-2024-127427.8A deserialization of untrusted data vulnerability exists in NI G Web Development Software that may result in arbitrary code execution.  Succ CVE-2024-127434.8The MailPoet WordPress plugin before 5.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such a CVE-2024-127448.0A SQL injection in the Amazon Redshift JDBC Driver in v2.1.0.31 allows a user to gain escalated privileges via the getSchemas, getTables, or CVE-2024-127458.0A SQL injection in the Amazon Redshift Python Connector v2.1.4 allows a user to gain escalated privileges via the get_schemas, get_tables, o CVE-2024-127468.0A SQL injection in the Amazon Redshift ODBC Driver v2.1.5.0 (Windows or Linux) allows a user to gain escalated privileges via the SQLTables CVE-2024-127475.6A flaw was found in rsync. This vulnerability arises from a race condition during rsync's handling of symbolic links. Rsync's default behavi CVE-2024-127497.1The Competition Form WordPress plugin through 2.0 does not sanitise and escape a parameter before outputting it back in the page, leading to CVE-2024-12759.1Use of Default Cryptographic Key vulnerability in Baxter Welch Allyn Connex Spot Monitor may allow Configuration/Environment Manipulation.Th CVE-2024-127504.3The Competition Form WordPress plugin through 2.0 does not have CSRF check in place when updating its settings, which could allow attackers CVE-2024-127517.8Foxit PDF Reader AcroForm Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbi CVE-2024-127527.8Foxit PDF Reader AcroForm Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbit