By vendor

Ni vulnerabilities

Known CVEs affecting Ni products, prioritized by severity, with SEC.co remediation and detection guidance.

7 published vulnerabilities

• CVE-2026-48138HIGH 7.5

  A vulnerability in the NI grpc-device streaming API allows attackers to read memory beyond proper bounds, potentially causing the application to crash or become unavailable. The flaw stems from missing validation when processing specially crafted network requests. No authentication is required to trigger the issue, making it accessible to anyone with network access to affected systems.

• CVE-2026-48139HIGH 7.5

  A NULL pointer dereference flaw exists in National Instruments' grpc-device data moniker service. An unauthenticated attacker can crash the affected service by sending a specially crafted request containing an unknown value. This denial-of-service vulnerability impacts NI grpc-device version 2.17.0 and earlier. The attack requires no user interaction and can be executed remotely, but does not allow data theft or system compromise—only service disruption.

• CVE-2026-8035HIGH 7.1

  CVE-2026-8035 is a denial-of-service vulnerability in National Instruments' PAL kernel driver that allows authenticated local users to crash the system. The flaw stems from inadequate input validation that fails to check for NULL pointers before dereferencing them in memory. An attacker with local system access can exploit this by supplying malformed input to the driver, causing an immediate kernel panic. The vulnerability affects NI-PAL version 26.3.0 and all earlier releases across both Windows and Linux platforms.

• CVE-2026-8036HIGH 7.1

  NI-PAL, National Instruments' process abstraction layer, contains an input validation flaw that allows authenticated local users to read and modify arbitrary memory regions on affected systems. An attacker with local access could exploit this to escalate their privileges. The vulnerability affects NI-PAL version 26.3.0 and earlier on both Windows and Linux platforms.

• CVE-2026-48140MEDIUM 6.5

  CVE-2026-48140 is a denial-of-service vulnerability in National Instruments' grpc-device component, specifically in the BeginSidebandStream function. An authenticated attacker can craft a malicious message containing an invalid enumeration value to trigger undefined behavior in the service, causing it to crash or become unavailable. The vulnerability affects NI grpc-device version 2.17.0 and earlier. Exploitation requires valid credentials but no special privileges or user interaction.

• CVE-2026-48141MEDIUM 5.3

  A memory leak exists in National Instruments' grpc-device BeginSidebandStream function that can be exploited to exhaust server memory and cause denial of service. An authenticated attacker can trigger this leak repeatedly, eventually forcing the affected service to crash or become unresponsive. The vulnerability affects NI grpc-device version 2.17.0 and earlier.

• CVE-2026-9143LOW 3.7

  CVE-2026-9143 is a numeric type conversion flaw in NI grpc-device that can silently truncate size values when they exceed the range of their target data type. The vulnerability stems from missing validation checks in the code generation layer. When a size value is too large for the target type, high bits are discarded without warning, potentially causing the service to operate on incorrect or undersized buffers. The issue affects NI grpc-device version 2.17.0 and earlier.