CVE Intelligence
Analysis AI-assisted

CVE-2026-48137: NI grpc-device Untrusted Pointer Dereference

An untrusted pointer dereference in the NI grpc-device sideband streaming API may allow an attacker to cause an arbitrary memory dereference, potentially leading to remote code execution. Exploitation requires a specially crafted Moniker protobuf message, and NVD scores the issue 9.8 under CVSS 3.1. No confirmed exploitation appears in the sources consulted, and the record lists no fixed version.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

The NI grpc-device sideband streaming API contains an untrusted pointer dereference weakness, catalogued as CWE-822. The CVE record describes a condition in which a specially crafted Moniker protobuf message could lead to an arbitrary memory dereference. Vendor information is available in the GitHub security advisory and the NI security bulletin.

Impact

  • The record states that successful exploitation may cause an arbitrary memory dereference, potentially resulting in remote code execution.
  • The NVD CVSS 3.1 vector describes a network attack vector, low complexity, no privileges required, no user interaction, and high impact to confidentiality, integrity and availability.
  • The vendor CNA also published scores of 9.3 under CVSS 4.0 and 9.1 under CVSS 3.1.

Affected products and versions

  • The description states that NI grpc-device 2.17.0 and prior versions are affected.
  • The structured affected list includes NI Grpc Device Server versions below 2.18.0.
  • The structured affected list includes NI InstrumentStudio versions 2025 and earlier, 2026-q1 and 2026-q2.
  • The record does not list fixed versions. Inferentially, 2.18.0 is the boundary of the affected range, but the record does not explicitly confirm it as a fixed release.

Exploitation status

The CISA KEV catalog does not list this CVE in the record. No confirmed active exploitation or exploitation in the wild appears in the sources consulted. The EPSS score is not available in the record.

Remediation and mitigation

  • Check the vendor advisories and identify all installations of NI grpc-device Server and NI InstrumentStudio.
  • Plan an update to the release specified by NI, and confirm the fixed version in the vendor advisory before rollout.
  • Until patched, limit network exposure of grpc-device services and restrict access to trusted clients only.
  • Apply the vendor's guidance for any affected InstrumentStudio components.

Detection guidance

  • Maintain an inventory of grpc-device server and InstrumentStudio versions across lab and industrial environments.
  • Monitor grpc-device server processes for unexpected crashes, restarts or memory errors, which may indicate abnormal input handling.
  • Review logs of sideband streaming activity for unusual sources or requests.

Limitations of the available information

  • The record contains no fixed versions, so the remediation target must be confirmed with the vendor.
  • There is no EPSS score, SSVC data or exploit detail in the record.
  • The affected version strings for InstrumentStudio use mixed formats, so mapping them to installed builds may require vendor confirmation.
  • The CVSS 3.1 score from NVD (9.8) differs from the vendor's CVSS 3.1 score (9.1), and the reason for the difference is not stated.
  • The record title is missing and was derived from the CWE and product context.

Frequently asked questions

What is CVE-2026-48137?

It is an untrusted pointer dereference vulnerability (CWE-822) in the NI grpc-device sideband streaming API. The record says it may allow an arbitrary memory dereference and potentially remote code execution.

Which versions are affected?

The description states that NI grpc-device 2.17.0 and prior versions are affected. The structured list also covers NI Grpc Device Server below 2.18.0 and several NI InstrumentStudio versions.

Is this vulnerability being actively exploited?

The CVE is not listed in the CISA KEV catalog in the record, and no confirmed exploitation appears in the sources consulted.

What should administrators do now?

Identify affected installations, follow the NI advisories to the fixed release, and restrict network access to grpc-device services until patched.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.