CVE-2026-48138: NI grpc-device out-of-bounds read in streaming API

Executive brief

NI grpc-device is a software component used to facilitate remote communication with measurement and automation hardware. A vulnerability in its streaming interface allows a remote attacker to crash the service by sending a specially crafted request. This can lead to a denial of service, interrupting hardware operations and automated testing workflows.

Technical details

An out-of-bounds read vulnerability (CWE-125) exists in the NI grpc-device streaming API due to a missing bounds check. The flaw is triggered when the server processes a specially crafted write request, leading to memory access outside of the intended buffer. This results in a service crash (denial of service). The vulnerability is reachable over the network without authentication and has low attack complexity. Users are advised to upgrade to NI grpc-device version 2.18.0 or later to remediate the issue.

Affected products

• NI grpc-device <= 2.17.0
• NI InstrumentStudio <= 26.3.0

Timeline

• 2026-06-19: disclosed
• 2026-06-19: advisory
• 2026-06-19: patched: Fixed in version 2.18.0

References

• https://github.com/ni/grpc-device/security/advisories/GHSA-8rjh-429j-f6gw
• https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/2026/multiple-vulnerabilities-in-ni-grpc-device-server.html