CVE-2024-12740
Published: 27 January 2025
Description
Vision related software from NI used a third-party library for image processing that exposes several vulnerabilities. These vulnerabilities may result in arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted file.
Security Summary
CVE-2024-12740 affects vision-related software from National Instruments (NI) that incorporates a third-party library for image processing. This library exposes several vulnerabilities which may result in arbitrary code execution. The vulnerability received a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H) and was published on 2025-01-27.
Exploitation requires local access and an attacker to convince a user to open a specially crafted file, with low attack complexity and no privileges needed. Successful attacks can achieve high impacts on confidentiality, integrity, and availability through arbitrary code execution.
NI has published a security advisory at https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/dependency-on-vulnerable-third-party-component-exposes-vulnerabi.html detailing the dependency on the vulnerable third-party component.
Details
- CWE(s)