# CVE-2026-48138: NI grpc-device out-of-bounds read in streaming API

Source: https://junglewise.ai/threats/cve-2026-48138-ni-grpc-device-out-of-bounds-read-in-streaming-api  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-19. Updated: 2026-06-21  
License: CC BY 4.0 with a link back

CVE-2026-48138 · Severity: high · CVSS 7.5 · Published 2026-06-19

NI grpc-device is a software component used to facilitate remote communication with measurement and automation hardware. A vulnerability in its streaming interface allows a remote attacker to crash the service by sending a specially crafted request. This can lead to a denial of service, interrupting hardware operations and automated testing workflows.

Technologies: [NI Grpc-Device](https://junglewise.ai/threats/technologies/grpc-device), [NI InstrumentStudio](https://junglewise.ai/threats/technologies/instrumentstudio). Vendors: [NI](https://junglewise.ai/threats/vendors/ni).

## Quick answers

**Is CVE-2026-48138 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48138 being exploited in the wild.

**How severe is CVE-2026-48138?** High severity, with a CVSS score of 7.5, published 19 June 2026.

**Which products and versions are affected?** NI Grpc-Device <= 2.17.0; NI InstrumentStudio <= 26.3.0.

**Is there a fix for CVE-2026-48138?** A patch was published on 2026-06-19: Fixed in version 2.18.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-48138 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-48138?** Check whether you run NI Grpc-Device or NI InstrumentStudio at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An out-of-bounds read vulnerability (CWE-125) exists in the NI grpc-device streaming API due to a missing bounds check. The flaw is triggered when the server processes a specially crafted write request, leading to memory access outside of the intended buffer. This results in a service crash (denial of service). The vulnerability is reachable over the network without authentication and has low attack complexity. Users are advised to upgrade to NI grpc-device version 2.18.0 or later to remediate the issue.

## Affected products

- NI grpc-device <= 2.17.0
- NI InstrumentStudio <= 26.3.0

## Timeline

- 2026-06-19: disclosed
- 2026-06-19: advisory
- 2026-06-19: patched: Fixed in version 2.18.0

## References

- [https://github.com/ni/grpc-device/security/advisories/GHSA-8rjh-429j-f6gw](https://github.com/ni/grpc-device/security/advisories/GHSA-8rjh-429j-f6gw)
- [https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/2026/multiple-vulnerabilities-in-ni-grpc-device-server.html](https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/2026/multiple-vulnerabilities-in-ni-grpc-device-server.html)

## Related threats

- [NI grpc-device incorrect numeric conversion in CodeGen](https://junglewise.ai/threats/cve-2026-9143-ni-grpc-device-incorrect-numeric-conversion-in-codegen)
- [NI grpc-device missing authentication when TLS is disabled](https://junglewise.ai/threats/cve-2026-9142-ni-grpc-device-missing-authentication-when-tls-is-disabled)
- [NI grpc-device memory leak in BeginSidebandStream](https://junglewise.ai/threats/cve-2026-48141-ni-grpc-device-memory-leak-in-beginsidebandstream)
- [NI grpc-device unchecked enum cast in BeginSidebandStream](https://junglewise.ai/threats/cve-2026-48140-ni-grpc-device-unchecked-enum-cast-in-beginsidebandstream)
- [NI grpc-device NULL pointer dereference in data moniker service](https://junglewise.ai/threats/cve-2026-48139-ni-grpc-device-null-pointer-dereference-in-data-moniker-service)