CVE-2026-48137

CRITICAL9.3

Untrusted pointer dereference in NI grpc-device sideband streaming API

Published Jun 19, 2026

Modified 1 months ago

Details

There is an untrusted pointer dereference vulnerability in the NI grpc-device sideband streaming API that may allow an attacker to cause an arbitrary memory dereference, potentially resulting in remote code execution. Successful exploitation requires an attacker to supply a specially crafted Moniker protobuf message. This affects NI grpc-device 2.17.0 and prior versions.

References

ADVISORY

https://github.com/ni/grpc-device/security/advisories/GHSA-ww59-ghm9-mm63

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2026-48137

ADVISORY

https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/2026/multiple-vulnerabilities-in-ni-grpc-device-server.html

CVSS Analysis

CVSS v4.0

9.3

Exploitability

Attack Vector