Executive brief
NI grpc-device is a framework used to remotely control hardware instruments via gRPC. A vulnerability in the code generation component could allow data to be incorrectly processed when converting between different number formats. This could lead to the silent loss of data or incorrect values being sent to connected hardware devices, potentially affecting the integrity of operations.
Technical details
An incorrect conversion between numeric types (CWE-681) exists in the CodeGen component of NI grpc-device. The vulnerability is caused by missing range checks when converting size values between different numeric types, which can lead to high bits being silently discarded if the value exceeds the capacity of the target type. An attacker could potentially exploit this over a network, though it requires high attack complexity. The flaw affects NI grpc-device versions 2.17.0 and prior, as well as InstrumentStudio versions 26.3.0 and prior. Users are advised to upgrade to NI grpc-device 2.18.0 or later.
Affected products
- NI grpc-device <= 2.17.0
- NI InstrumentStudio <= 26.3.0
Timeline
- 2026-06-19: advisory: NI and GitHub Security Advisory published
- 2026-06-19: disclosed
- 2026-06-19: patched: Fixed in version 2.18.0