Executive brief
A memory leak exists in the NI gRPC Device Server, a component used to facilitate remote communication with National Instruments hardware. An attacker can exploit this flaw to consume all available system memory, eventually causing the software to crash or become unresponsive. This results in a denial-of-service condition that can disrupt automated testing or industrial control operations.
Technical details
A memory leak (CWE-401) exists in the 'BeginSidebandStream' function of the NI gRPC Device Server. The vulnerability is triggered when the software fails to release allocated memory after its effective lifetime during sideband streaming operations. An authenticated remote attacker can exploit this by repeatedly initiating specific streaming requests, leading to gradual memory exhaustion and an eventual denial-of-service (DoS) condition. The attack complexity is rated as high, likely due to specific timing or environmental requirements to successfully trigger the leak. The issue is addressed in NI grpc-device version 2.18.0.
Affected products
- NI grpc-device <= 2.17.0
- NI InstrumentStudio <= 26.3.0
Timeline
- 2026-06-19: disclosed
- 2026-06-19: advisory
- 2026-06-19: patched: Fixed in version 2.18.0