Importance of Installing Security Updates

[PinguX]

---

@Evan_C  a écrit :

Feedback from you on why you think users aren't installing critical security patches, and what we could do differently to reach users.

---

For the first part of the question, my assumptions are :

1. People haven't heard about the security patches. As for me, it was in this publication that I first heard about this security vulnerability—and about any security vulnerability related to LabVIEW.

2. Most LabVIEW users do not come from an IT background, so they're not very concerned about cybersecurity. At least from what I've seen around me over the last ten years (myself included).

3. Once bitten, twice shy. If we have to choose between a stable environment, and cybersecurity: the former allows us to work, whereas the latter might not.

For the second part : I do not know, because there is no centralized communication channel that allows everyone to be reached via a single method.

From now on, the simplest thread I will follow is the US NVD, as it shows everything in detail.

[softball]

Hi

I agree to Frozen's observations.

I have LabVIEW 2022 Q3 installed as the newest.

With a matching NI-VISA 22.5.

And NI-PAL ( probably included with VISA ) is 22.8.

So, will NI-PM freshly updated to 26.5.0 show any update options to this configuration ?

The answer is NO. There is neither an update to NI-VISA nor an update for NI-PAL.

Now, NI-PAL is piggybacking on other components as Evan_C explains. It don't have its own installer.

So, maybe a new NI-PAL version is included with another component, that works with LabVIEW 2022 Q3.

The answer to that question is likely another NO. But see below ..

So, the summary for my situation is that LabVIEW 2022 Q3 is an unsafe version to use going forward.

But maybe it is not really so.

Because we have LabVIEW Addons since 2022.

And NI states this :

softball_0-1787727586642.png

So NI-VISA can be updated to the newest ( including the desired version of NI-PAL ) even using LabVIEW 2022 Q3.

NI Package Manager don't know that, apparently. And don't suggest any update. A kind of flaw.

I have not updated to the newest NI-VISA yet. As others also note, 'we' don't just do that.

But I keep my fingers crossed, when I eventually do.

Regards

PS : For those using older versions of LabVIEW, like 2021, there is no help, it seems.

[Martin_Henz]

I decided to be bold and installed VISA 26.5.0 on a laptop running LabVIEW 2021. To be more specific:
I started by installing it on a laptop I don't really need. I renamed the LabVIEW 2021 directories and then installed NI-VISA 26.5.0. On the first laptop, an error message appeared during installation. After clicking the "Retry" button, the installer started over from the beginning. Another error message appeared—a different one this time. I then checked the version of `nipalk.sys`; it had been updated. I subsequently cancelled the installation.
I ran a few tests to see if VISA was still working. Initially, the VISA control didn't detect my serial ports. I opened NI-MAX, and they were visible there. After that, it worked in LabVIEW as well. I performed a few more tests, and it seems to be functioning correctly. As far as I can tell right now, the installers created with LabVIEW also seem to include the updated NI-PAL. After three hours—with the installer alone taking two hours—I was satisfied with the result for the time being.
Next, I updated a second laptop. Everything ran without error messages there, and I haven't noticed any negative effects so far. The installer took about two hours on this machine as well.
Now I'm working on a third PC. The installation has been running for five hours. Yes, it is still progressing, and there haven't been any error messages so far. Based on my current assessment, it will take another hour for the installer to finish.

Is it really possible that the NI-VISA installer takes anywhere from two to well over five hours to complete?

[BertMcMahan]

---

@Martin_Henz wrote:

Is it really possible that the NI-VISA installer takes anywhere from two to well over five hours to complete?

---

Yep- all of NI's installers are very, very slow with the current state of Windows' AV scanning. I think NI is trying to improve it with NIPM, but it still takes forever. They have at least acknowledged it, which is better than nothing. Fingers crossed it's on a short to-do list!

[softball]

Hi

It is a problem that NI don't have three statements like :

- what NI has tested that will work ( they do have that statement )

- what NI has not tested but might work ( which is very fair, but NI is silent about that )

- what NI knows does not work ( NI is also silent on that )

We all know all this hardware and software and drivers are complicated stuff.

Many could not wait until NI stated that Windows 10 was safe to use, or Windows 11 for that matter.

And just started using NI stuff with the unapproved OS's. And usually it worked.

The reason I came to think of this is, that I was looking at NI's statements about LabVIEW's support for NI-VISA.

I have already mentioned the nice webpage :

https://www.ni.com/en/support/documentation/supplemental/22/extending-compatibility-between-labview-...

softball_0-1787756989160.png

LabVIEW 2022 Q3 should work with the newest NI-VISA version. And the webpage states 'Updated Jun 26, 2026 ' so it should be pretty up to date. Well, it is not. It is apparently written in 2024. At that time the information was correct. But not now.

NI have another webpage :

https://www.ni.com/en/support/documentation/compatibility/23/ni-driver-and-development-software-comp...

softball_1-1787757409802.png

This webpage says that in 2024 you could even use the then newest NI-VISA with not only LabVIEW 2022 Q3 but also the older LabVIEW 2021. 

However the webpage also states that NI-VISA 2026 Q3 is only compatible with LabVIEW 2023 or newer/later. That is bad.

But does this means that NI-VISA 2026 Q3 will not work with LabVIEW 2022 Q3 ?

Or does it mean that NI has not tested that combination ?

Well, I have done as Martin_Henz. I found a partition with a pretty clean LabVIEW 2022 Q3 and installed NI-VISA 2026 Q3. And a cursory check indicates that it works. NI MAX and LabVIEW can see and access VISA resources.

NI stuff is slowly turning into black boxes. No specific readme's for releases and you are on your own testing things out.

I don't mind testing things out. But I would prefer to know, whether NI just did not test a combination, or maybe even know that it will not work. 

Regards

PS : Before being brave and just install the newest NI-VISA, I also considered the option of just installing the newest NI-PAL 'software'. It is merely a driver, ( see : https://github.com/magicsword-io/LOLDrivers/issues/303 ). Looking into the NI-VISA ISO file there is a NIPKG file including NI-PAL in the name. Double clicking on it opened NIPM and it started checking dependencies. After an hour I stopped it.

[softball]

Hi

Just a final summary from me about getting the updated NI-PAL for use with LabVIEW 2022 Q3.

It does not work.

The problem is that NI-VISA 2026 Q3 is not compatible with LabVIEW 2022 Q3. And it is really not compatible.

I wanted to test the combination with a myRIO.

But there were no option to upload LabVIEW components to the device.

No feed option neither online nor offline as I normally have. Just this unexpected panel :

softball_0-1787826742175.png

So, I restored the computer image back to what it was before installing the new NI-VISA 2026 Q3. And then things worked again. Lesson learned.

Regards

[Yamaeda]

I'll install it when we upgrade from LV2019 on our oldest systems.

[softball]

Hi again

Couldn't resist trying to install the NI-PAL related NIPKG, standalone again.

Meaning, I now copied the file ni-pal_26.5.0.49395-0+f243_windows_x64.nipkg from the ISO file to the local disk and then double clicked on it.

NI Package Manager must be the newest and it opened and very quickly decided it could install the package. And so it did. There is only this package to install.

The result is this nice view :

softball_0-1787851142982.png

NI_PAL 26.5 is installed, yet everything else is still from 2022 Q3.

Now, I have tried VISA from NI MAX. It works. I have done a complete refresh of the myRIO. It works. 

Maybe this is something for Evan_C to consider and comment.

Regards  

[PinguX]

Hello there,

The CVE-2026-18485, for which we should update NI-PAL, required a local authenticated user (and NI-PAL installed) to be used by an attacker.

We are now dealing with 8 vulnerabilities affecting LabVIEW 2026 Q3 and all prior versions. Exploiting them requires opening a VI that the attacker has sent us.

https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/2026/...

https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/2026/...

https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/2026/...

Does the CVE-2026-18485, combined with one of the 8 news CVE, allow anyone to gain privileged access to our computer if we make the mistake of downloading and opening a VI that a forum member has uploaded to seek help ?

Or download community packages from VI Package Manager ?

For all those news vulnerabilities, security updates are available for Q3 of LabVIEW 2023/2024/2025/2026.

If I'm still using LabVIEW 2022 or prior, am I screwed ?

Is a perpetual license equivalent to a three-year term if I cannot receive critical security updates ?

Finally, starting today, should we use a virtual machine with LabVIEW to help each other out on this forum ?

And if that is the case, are professional users allowed to use a "Community Edition" license for this specific use case ?

(Computer with LabVIEW Professional or Full for work, Virtual Machine with LabVIEW Community Edition for forum)

[rolfk]

---

@Evan_C wrote:

Feedback from you on why you think users aren't installing critical security patches, and what we could do differently to reach users.

---

Just as others said, I only learned about this when reading this thread. I have NI Update not (intentionally) disabled and get sometimes popups from it about some new software. Usually various LabVIEW runtime systems versions that I have really lost any control off why they would be all needed when the according LabVIEW version is not present and I'm not aware of any applications I may have build myself and installed (This is my development machine and I almost always run from sources).

There are of course other trouble. Once NI Updater determined that there is something to update it wants to open an overview and then clicking on anything in there takes ages (and I really mean ages as I could easily get half a dozen coffees in that time) until it usually determines that I first have to update NIPM before it would even consider to proceed any further. I hate that as I had more than once that this caused some NI components to be updated that suddenly disabled certain features (such as creating 32-bit installers around 2020/2021). After accepting to update NIPM, which takes again ages to do, it wants to refresh the status about what might need to be installed, which of course takes another several ages. Then you get some packages that it wants to update, possibly interrupted with an intermediate restart, and of course after such a restart it takes another few ages to refresh the status of what still might need to be updated.

And if you want to install anything substantial, like an NI DAQmx driver update things really start to get out of hand, not to speak about a new LabVIEW suite!!!

These extreme wait times are annoying but hey doing things right can take time of course. Except that it still manages to mess up systems sometimes to the point where I had to do a complete wipe of the disk by having IT do a fresh system install, in order to be able to install certain packages as I got otherwise all kind of obscure compatibility errors during the install.