CVE-2026-48141: NI grpc-device Memory Leak DoS Vulnerability

Technical summary

CVE-2026-48141 is a CWE-401 (Missing Release of Memory after Effective Lifetime) vulnerability in the BeginSidebandStream implementation within NI grpc-device. Each invocation of this function fails to properly deallocate memory, allowing an authenticated user to initiate repeated sideband streams and accumulate memory allocations until resource exhaustion occurs. The gRPC-based protocol handling does not implement adequate memory lifecycle management for stream objects, creating a classic memory leak condition that degrades into availability loss.

Business impact

Organizations relying on NI grpc-device for instrument control or data acquisition face potential service disruptions. An authenticated user with access to the gRPC interface can mount a denial-of-service attack without requiring privileged escalation, forcing system restarts or service restarts to recover. In production environments where NI tools support critical measurement, testing, or manufacturing workflows, unplanned downtime can disrupt operations and delay time-sensitive tasks.

Affected systems

NI grpc-device version 2.17.0 and all prior releases are vulnerable. The vulnerability also affects NI InstrumentStudio instances that depend on the vulnerable grpc-device component. Any deployment running these products should be assessed for exposure, particularly where the gRPC service is accessible to authenticated network users.

Exploitability

Exploitation requires valid authentication credentials (PR:L in the CVSS vector), and the attacker must have network access to the gRPC interface. The attack complexity is noted as High (AC:H), likely due to timing or specific conditions needed to reliably trigger the leak. No public exploit code or KEV listing exists as of the advisory date, but the attack is straightforward once access is obtained: repeatedly calling BeginSidebandStream until memory is exhausted.

Remediation

Apply the latest NI grpc-device patch that addresses the memory leak in BeginSidebandStream. Verify the patch version against the official NI security advisory. Organizations unable to patch immediately should implement network-level access controls to restrict gRPC service access to trusted internal users only, and monitor memory consumption on affected systems for signs of exploitation.

Patch guidance

Check the NI security advisory for the specific patched version of grpc-device that resolves CVE-2026-48141. Update NI grpc-device and any dependent NI InstrumentStudio installations to the recommended version. Test patched versions in a non-production environment first to ensure compatibility with existing measurement scripts and workflows. After patching, restart affected services to clear any residual memory state.

Detection guidance

Monitor gRPC service logs for repeated BeginSidebandStream calls from a single authenticated user over a short time period. Track memory utilization trends on systems running NI grpc-device; a steady, unchecked increase in resident memory despite stable workload may indicate active exploitation. Set alerting thresholds for memory consumption approaching system limits. If available, enable gRPC tracing and audit logs to capture sideband stream initiation patterns.

Why prioritize this

Although rated MEDIUM severity with a CVSS score of 5.3, this vulnerability merits prompt attention because it requires only authentication (a common condition in many deployments) and leads to direct service unavailability. The absence of complexity around exploitation execution and the simplicity of triggering the leak multiple times make it a practical denial-of-service vector. Organizations should prioritize patching based on whether their NI infrastructure is exposed to untrusted authenticated users or if service availability is critical to operations.

Risk score, explained

The CVSS:3.1 score of 5.3 reflects a MEDIUM severity due to the attack vector being network-based (AV:N), the requirement for low-level authentication (PR:L), no user interaction needed (UI:N), and high impact on availability (A:H). The Attack Complexity is High (AC:H), which moderates the score, likely accounting for conditions or timing sensitivity in reproducing the leak reliably. The vulnerability carries no confidentiality or integrity impact—only availability is at risk.

Frequently asked questions