NI Vision Builder AI VBAI File Processing Remote Code Execution (CVE-2025-2450)
National Instruments' Vision Builder AI software contains a remote code execution vulnerability in VBAI file processing that allows attackers to execute arbitrary code through malicious files, according to a Zero Day Initiative public advisory released after months of unsuccessful remediation efforts.
What happened
NI Vision Builder AI contains a remote code execution vulnerability in its processing of VBAI files. The vulnerability allows execution of dangerous script without user warning when a target visits a malicious page or opens a malicious file.
Reported impact
An attacker can leverage this vulnerability to execute code in the context of the current user.
Index analysis
The vulnerability has a CVSS score of 7.8 with high confidentiality, integrity and availability impact. It requires local access and user interaction.
Governance controls
National Instruments initially communicated on 12/19/24 that the reported behaviour was not a security issue. The Zero Day Initiative disclosed the vulnerability publicly on 2025-03-17 after the vendor did not remediate it following disclosure on 2024-04-26.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.