# CVE-2026-48140: NI grpc-device unchecked enum cast in BeginSidebandStream

Source: https://junglewise.ai/threats/cve-2026-48140-ni-grpc-device-unchecked-enum-cast-in-beginsidebandstream  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-19. Updated: 2026-06-21  
License: CC BY 4.0 with a link back

CVE-2026-48140 · Severity: medium · CVSS 6.5 · Published 2026-06-19

NI grpc-device is a framework used to interface with National Instruments hardware over a network. A vulnerability in its sideband streaming component allows an authenticated user to crash the service by sending a specially crafted message. This can lead to a denial of service, disrupting hardware communication and automated testing operations.

Technologies: [NI Grpc-Device](https://junglewise.ai/threats/technologies/grpc-device), [NI InstrumentStudio](https://junglewise.ai/threats/technologies/instrumentstudio). Vendors: [NI](https://junglewise.ai/threats/vendors/ni).

## Quick answers

**Is CVE-2026-48140 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48140 being exploited in the wild.

**How severe is CVE-2026-48140?** Medium severity, with a CVSS score of 6.5, published 19 June 2026.

**Which products and versions are affected?** NI Grpc-Device <= 2.17.0; NI InstrumentStudio <= 26.3.0.

**Is there a fix for CVE-2026-48140?** A patch was published on 2026-06-19: Version 2.18.0 released to address the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-48140 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-48140?** Check whether you run NI Grpc-Device or NI InstrumentStudio at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An unchecked enum cast vulnerability (CWE-704) exists in the BeginSidebandStream function of the NI grpc-device server. The root cause is a failure to validate input values before casting them to an internal enumeration type. An authenticated attacker can exploit this by sending a gRPC message containing an out-of-range value, triggering an invalid state or undefined behavior. This typically results in a service crash (denial of service). The vulnerability is addressed in NI grpc-device version 2.18.0.

## Affected products

- NI grpc-device <= 2.17.0
- NI InstrumentStudio <= 26.3.0

## Timeline

- 2026-06-19: advisory: NI and GitHub Security Advisory published
- 2026-06-19: patched: Version 2.18.0 released to address the issue

## References

- [https://github.com/ni/grpc-device/security/advisories/GHSA-prfr-q8h3-mqxv](https://github.com/ni/grpc-device/security/advisories/GHSA-prfr-q8h3-mqxv)
- [https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/2026/multiple-vulnerabilities-in-ni-grpc-device-server.html](https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/2026/multiple-vulnerabilities-in-ni-grpc-device-server.html)

## Related threats

- [NI grpc-device incorrect numeric conversion in CodeGen](https://junglewise.ai/threats/cve-2026-9143-ni-grpc-device-incorrect-numeric-conversion-in-codegen)
- [NI grpc-device missing authentication when TLS is disabled](https://junglewise.ai/threats/cve-2026-9142-ni-grpc-device-missing-authentication-when-tls-is-disabled)
- [NI grpc-device memory leak in BeginSidebandStream](https://junglewise.ai/threats/cve-2026-48141-ni-grpc-device-memory-leak-in-beginsidebandstream)
- [NI grpc-device NULL pointer dereference in data moniker service](https://junglewise.ai/threats/cve-2026-48139-ni-grpc-device-null-pointer-dereference-in-data-moniker-service)
- [NI grpc-device out-of-bounds read in streaming API](https://junglewise.ai/threats/cve-2026-48138-ni-grpc-device-out-of-bounds-read-in-streaming-api)