Is CVE-2026-48138 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-48138 being exploited in the wild.

How severe is CVE-2026-48138?

High severity, with a CVSS score of 7.5, published 19 June 2026.

Which products and versions are affected?

NI Grpc-Device <= 2.17.0; NI InstrumentStudio <= 26.3.0.

Is there a fix for CVE-2026-48138?

A patch was published on 2026-06-19: Fixed in version 2.18.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-48138 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-48138?

Check whether you run NI Grpc-Device or NI InstrumentStudio at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-48138: NI grpc-device out-of-bounds read in streaming API

Q: Which products and versions are affected?

NI Grpc-Device <= 2.17.0; NI InstrumentStudio <= 26.3.0.

Q: Is there a fix for CVE-2026-48138?

A patch was published on 2026-06-19: Fixed in version 2.18.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-48138 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-48138?

Check whether you run NI Grpc-Device or NI InstrumentStudio at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-48138 · Severity: high · CVSS 7.5 · Published 2026-06-19

NI grpc-device is a software component used to facilitate remote communication with measurement and automation hardware. A vulnerability in its streaming interface allows a remote attacker to crash the service by sending a specially crafted request. This can lead to a denial of service, interrupting hardware operations and automated testing workflows.

Technologies: NI Grpc-Device, NI InstrumentStudio. Vendors: NI.

Quick answers

Is CVE-2026-48138 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-48138 being exploited in the wild.
How severe is CVE-2026-48138?: High severity, with a CVSS score of 7.5, published 19 June 2026.
Which products and versions are affected?: NI Grpc-Device <= 2.17.0; NI InstrumentStudio <= 26.3.0.
Is there a fix for CVE-2026-48138?: A patch was published on 2026-06-19: Fixed in version 2.18.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48138 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-48138?: Check whether you run NI Grpc-Device or NI InstrumentStudio at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An out-of-bounds read vulnerability (CWE-125) exists in the NI grpc-device streaming API due to a missing bounds check. The flaw is triggered when the server processes a specially crafted write request, leading to memory access outside of the intended buffer. This results in a service crash (denial of service). The vulnerability is reachable over the network without authentication and has low attack complexity. Users are advised to upgrade to NI grpc-device version 2.18.0 or later to remediate the issue.

Affected products

NI grpc-device <= 2.17.0
NI InstrumentStudio <= 26.3.0

Timeline

2026-06-19: disclosed
2026-06-19: advisory
2026-06-19: patched: Fixed in version 2.18.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.