NI Vision Software vulnerable to CVE-2024-12740 via third-party image processing library
NI disclosed that multiple versions of its vision software products contain a vulnerability (CVE-2024-12740) in a third-party image processing library that could allow arbitrary code execution if a user opens a malicious file. NI has replaced the vulnerable component and released updates for affected products.
What happened
NI's vision-related software uses a third-party library for image processing that contains multiple vulnerabilities identified as CVE-2024-12740.
Successful exploitation requires an attacker to get a user to open a specially crafted file, which may result in arbitrary code execution.
NI has replaced the vulnerable third-party library and released updates to mitigate the vulnerabilities.
Reported impact
The vulnerabilities may result in arbitrary code execution.
Index analysis
CVE-2024-12740 has a CVSS score of 7.8, indicating a high-severity vulnerability affecting multiple NI products including Vision Development Module, FlexRIO, Vision Acquisition Software, NI-IMAQdx, Vision Builder for Automated Inspection, and Data Record AD.
Governance controls
NI strongly recommends upgrading affected software to the latest versions available through NI Package Manager or Software Downloads.
If upgrades are not immediately possible, users can install Vision Common Resources 2025 Q1 or later as a mitigation measure.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.