CVE-2026-9143: NI grpc-device Numeric Type Conversion Vulnerability

Technical summary

The vulnerability is classified as CWE-681 (Incorrect Conversion Between Numeric Types) and occurs in the CodeGen component of NI grpc-device. The root cause is the absence of range-checking logic when converting size parameters between numeric types. When a size value exceeds the maximum representable value of the target type, truncation occurs silently. This can result in memory allocations, buffer operations, or data transfers being performed on incorrect sizes, potentially leading to buffer overflows, data corruption, or unexpected behavior in downstream processing.

Business impact

While rated LOW severity, this vulnerability could impact operations relying on NI grpc-device for industrial automation, measurement, or instrumentation workloads. Silent data truncation could lead to subtle data integrity issues that are difficult to detect in production environments. Organizations using NI InstrumentStudio or NI grpc-device server for critical measurement or control tasks should assess whether their deployments process size values near numeric type boundaries. The impact is primarily limited to data integrity rather than confidentiality or availability, but cumulative effects in long-running processes could be material.

Affected systems

NI grpc-device version 2.17.0 and prior versions are affected. This includes deployments of NI InstrumentStudio and NI grpc-device server that rely on the vulnerable CodeGen implementation. The vulnerability is present in the gRPC device communication layer and affects any caller that passes size parameters through the affected conversion routines.

Exploitability

Exploitation requires network access and specific conditions to trigger the conversion overflow, reflected in the CVSS score of 3.7 (LOW). The vulnerability is not trivial to exploit in real-world scenarios because it depends on application-level logic that sends size values exceeding the target type's range. However, it is not a network-amplification or authentication-dependent issue. Malicious actors cannot directly exploit this remotely without sender cooperation or application-level fuzzing; most practical impact is from unintended misuse or edge-case handling.

Remediation

Upgrade NI grpc-device to a patched version released after 2.17.0. Consult NI's official security advisories and release notes to confirm the specific version that addresses this vulnerability. Organizations should validate the upgrade path for their InstrumentStudio and grpc-device server deployments to ensure compatibility with dependent systems.

Patch guidance

Monitor NI's security bulletins and software update channels for a release addressing CVE-2026-9143. Once available, prioritize testing the patch in a non-production environment that mirrors your instrumentation infrastructure. Verify that size-dependent operations (buffer allocations, data transfers) continue to function correctly after patching. Coordinate the upgrade with your measurement and control processes to minimize downtime.

Detection guidance

Look for gRPC errors, buffer overflows, or data corruption events in logs from NI grpc-device deployments, particularly when processing unusually large size parameters. Monitor for size-mismatch warnings or truncation indicators in CodeGen output. Consider instrumenting size-validation assertions in applications that call grpc-device to catch cases where size values are unexpectedly reduced. Network-based detection is limited without deep inspection of gRPC payloads; endpoint monitoring on servers running grpc-device is more practical.

Why prioritize this

Although CVE-2026-9143 carries a LOW CVSS score, it should be assessed in the context of your specific use of NI grpc-device. Organizations using it for time-sensitive measurement, control systems, or data acquisition should prioritize patching to ensure data integrity. The silent nature of the truncation (no error, just lost bits) makes this particularly concerning in scenarios where size validation is not explicitly enforced by the application. If you do not use NI InstrumentStudio or grpc-device, this is not a priority.

Risk score, explained

The CVSS 3.1 score of 3.7 reflects LOW severity due to the attack vector requiring network access (AV:N), high complexity (AC:H), no requirement for privilege or user interaction, and impact limited to integrity (I:L) with no effect on confidentiality or availability. The high complexity reflects that triggering the overflow requires specific, often application-dependent conditions. The lack of availability impact (no denial-of-service capability) and confidentiality impact (no information disclosure) further reduce the base score.

Frequently asked questions