Executive brief
NI grpc-device is a framework used to enable remote communication with measurement and automation hardware. A critical vulnerability in its sideband streaming interface allows a remote attacker to potentially execute unauthorized code on the system. This could lead to a complete takeover of the device, resulting in data theft or disruption of industrial and laboratory operations.
Technical details
An untrusted pointer dereference (CWE-822) exists in the NI grpc-device sideband streaming API. The vulnerability is triggered when the server processes a specially crafted 'Moniker' protobuf message, where a value provided by the attacker is converted into a pointer and dereferenced without proper validation. This flaw allows a remote, unauthenticated attacker to cause an arbitrary memory dereference, which can be leveraged for remote code execution (RCE). The issue affects NI grpc-device versions 2.17.0 and prior, and has been patched in version 2.18.0.
Affected products
- NI grpc-device <= 2.17.0
- NI InstrumentStudio <= 26.3.0
Timeline
- 2026-06-19: disclosed
- 2026-06-19: advisory
- 2026-06-19: patched: Fixed in version 2.18.0