CVE-2026-48138: Out-of-Bounds Read in NI grpc-device Streaming API

Technical summary

CVE-2026-48138 is an out-of-bounds read vulnerability (CWE-125) in the NI grpc-device streaming API affecting versions 2.17.0 and prior. The vulnerability arises from inadequate bounds checking during write request processing. An unauthenticated remote attacker can send a malformed request to trigger an out-of-bounds read, leading to denial of service by crashing the grpc-device service. The CVSS 3.1 score of 7.5 reflects high severity due to network accessibility and lack of required privileges, though impact is limited to availability.

Business impact

Exploitation of this vulnerability can disrupt critical measurement and control operations dependent on NI hardware interfaces. Organizations relying on grpc-device for remote instrumentation or automated testing may experience service interruptions, delayed data collection, or halted production workflows. The availability impact is particularly significant for time-sensitive or safety-critical applications in manufacturing, research, and quality assurance environments.

Affected systems

National Instruments grpc-device server version 2.17.0 and all prior versions are vulnerable. This includes deployments integrated with NI InstrumentStudio and other applications that rely on the grpc-device streaming API for hardware communication. The vulnerability affects both standalone grpc-device installations and embedded instances within larger NI software suites.

Exploitability

Exploitation requires network access to the grpc-device service and the ability to send a specially crafted write request, but no authentication or user interaction is necessary. The attack surface is straightforward—any exposed grpc-device endpoint is at risk. However, successful exploitation depends on precise crafting of the malicious request, limiting casual exploitation. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog, suggesting active exploitation in the wild has not yet been documented at scale.

Remediation

Update NI grpc-device to a patched version newer than 2.17.0. Verify the specific patched version through the National Instruments security advisory. Additionally, implement network segmentation to restrict access to grpc-device services to trusted systems only, and disable the grpc-device streaming API if it is not required for your deployment.

Patch guidance

Consult the National Instruments security advisory for the specific patched version number and deployment instructions. Prioritize patching systems that expose grpc-device to untrusted networks. Test patches in a controlled environment before production deployment, particularly for systems hosting time-sensitive instrumentation. NI may provide cumulative updates or separate security patches—verify the exact version available for your deployment architecture.

Detection guidance

Monitor grpc-device services for unexpected crashes or availability drops that may indicate exploitation attempts. Implement network-level detection by analyzing gRPC traffic for abnormal request patterns, particularly write requests with unusual payload sizes or structures. Review application logs and system event logs for segmentation faults or service restarts coinciding with suspicious network activity. Consider deploying network intrusion detection signatures specific to malformed grpc-device requests once vendor signatures become available.

Why prioritize this

This vulnerability merits prompt attention due to its high CVSS score, lack of authentication barriers, and potential to disrupt operational technology environments. Organizations running exposed grpc-device instances—especially in manufacturing or research settings—should prioritize patching. The absence of documented active exploitation provides a window to patch before the vulnerability gains widespread weaponization.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects a network-accessible denial-of-service vulnerability with no privilege or interaction requirements. The impact is constrained to availability, preventing a critical severity rating. The straightforward attack vector (AV:N), low attack complexity (AC:L), and absence of authentication (PR:N) drive the elevated score despite the availability-only impact.

Frequently asked questions