CVE-2026-48137
There is an untrusted pointer dereference vulnerability in the NI grpc-device sideband streaming API that may allow an attacker to cause an arbitrary memory dereference, potentially resulting in remote code execution. Successful exploitation requires an attacker to supply a specially crafted Moniker protobuf message. This affects NI grpc-device 2.17.0 and prior versions.
- Score
- CVSS 3.1 9.8 Critical
- Status
- Analyzed - security@ni.com
- Published
- 2026-06-19
- Last modified
- 2026-06-22
- Weaknesses
- CWE-822
Affected products
References
- https://github.com/ni/grpc-device/security/advisories/GHSA-ww59-ghm9-mm63
- https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/2026/multiple-vulnerabil…
