Skip to content
OpenAdvisories
Critical · 9.1 CVE-2026-48137 EUVD-2026-38012

Untrusted pointer dereference in NI grpc-device sideband streaming API

Published Jun 19, 2026 · Updated Jun 22, 2026 · Assigned by NI

Description

There is an untrusted pointer dereference vulnerability in the NI grpc-device sideband streaming API that may allow an attacker to cause an arbitrary memory dereference, potentially resulting in remote code execution.  Successful exploitation requires an attacker  to supply a specially crafted Moniker protobuf message.  This affects NI grpc-device 2.17.0 and prior versions.

Affected products

VendorProductAffectedFixed
NI grpc-device ≤ 2.17.0 —
NI InstrumentStudio ≤ 26.3.0 —

References