Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2025-2450: NI Vision Builder AI Can Run Malicious Code Without Warning

CVE-2025-2450 · published 1 year ago

Summary

Attackers can trick users into opening malicious files or visiting fake websites, which can then execute code on the user's computer. This can lead to unauthorized access to sensitive data or system compromise. Users should be cautious when opening files or clicking on links, and ensure they only interact with trusted sources.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
ni	vision_builder_ai	2023 `cpe:2.3:a:ni:vision_builder_ai:2023:q3::::::`

Original advisory text

NI Vision Builder AI VBAI File Processing Missing Warning Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NI Vision Builder AI. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the processing of VBAI files. The issue results from allowing the execution of dangerous script without user warning. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-22833.

References

https://www.zerodayinitiative.com/advisories/ZDI-25-147/ Third Party Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

8.8 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-356Product UI does not Warn User of Unsafe Actions

Timeline

Published18 Mar 2025

Updated4 Nov 2026

First seen7 Mar 2026

Sources

CVE-2025-2450 · NVD

Track software like this

Free during beta