Skip to content
OpenAdvisories
High · 7.5 CVE-2026-48138 EUVD-2026-38022

Out-of-bounds read vulnerability in the NI grpc-device streaming API

Published Jun 19, 2026 · Updated Jun 22, 2026 · Assigned by NI

Description

There is an out-of-bounds read vulnerability in the NI grpc-device streaming API due to a missing bounds check that may result in a denial of service. Successful exploitation requires an attacker to supply a specially crafted write request. This affects NI grpc-device 2.17.0 and prior versions.

Affected products

VendorProductAffectedFixed
NI grpc-device ≤ 2.17.0 —
NI InstrumentStudio ≤ 26.3.0 —

References