CVE-2026-48140: NI grpc-device unchecked enum cast in BeginSidebandStream

Executive brief

NI grpc-device is a framework used to interface with National Instruments hardware over a network. A vulnerability in its sideband streaming component allows an authenticated user to crash the service by sending a specially crafted message. This can lead to a denial of service, disrupting hardware communication and automated testing operations.

Technical details

An unchecked enum cast vulnerability (CWE-704) exists in the BeginSidebandStream function of the NI grpc-device server. The root cause is a failure to validate input values before casting them to an internal enumeration type. An authenticated attacker can exploit this by sending a gRPC message containing an out-of-range value, triggering an invalid state or undefined behavior. This typically results in a service crash (denial of service). The vulnerability is addressed in NI grpc-device version 2.18.0.

Affected products

• NI grpc-device <= 2.17.0
• NI InstrumentStudio <= 26.3.0

Timeline

• 2026-06-19: advisory: NI and GitHub Security Advisory published
• 2026-06-19: patched: Version 2.18.0 released to address the issue

References

• https://github.com/ni/grpc-device/security/advisories/GHSA-prfr-q8h3-mqxv
• https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/2026/multiple-vulnerabilities-in-ni-grpc-device-server.html