CVE-2026-48137: NI InstrumentStudio RCE Vulnerability

CVE-2026-48137 Overview

CVE-2026-48137 is an untrusted pointer dereference vulnerability in the National Instruments (NI) grpc-device sideband streaming API. An attacker who delivers a specially crafted Moniker protobuf message to the server can cause an arbitrary memory dereference. Successful exploitation may result in remote code execution on the host running the NI gRPC device server. The flaw affects NI grpc-device version 2.17.0 and prior, and is reachable over the network without authentication or user interaction. NI tracks this issue under advisory GHSA-ww59-ghm9-mm63 and has published fixed software through its security update portal.

Critical Impact
Unauthenticated network attackers can trigger arbitrary memory dereferences in the NI gRPC device server, potentially leading to remote code execution on test and measurement systems.

Affected Products

NI grpc-device server versions 2.17.0 and prior
NI InstrumentStudio 2026 Q1
NI InstrumentStudio 2026 Q2

Discovery Timeline

2026-06-19 - CVE-2026-48137 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-48137

Vulnerability Analysis

The vulnerability resides in the sideband streaming API exposed by the NI grpc-device server. The server accepts Moniker protobuf messages that describe how to access device data through high-throughput sideband channels. When the server processes a malformed Moniker, it treats attacker-supplied bytes as a valid pointer and dereferences that pointer directly. The condition maps to [CWE-822: Untrusted Pointer Dereference]. Because the dereferenced address is attacker-controlled, the process can be steered to read or write arbitrary memory locations, which is the primitive needed for full code execution. The gRPC service typically runs on the same host as InstrumentStudio and other NI tooling, exposing engineering workstations and automated test racks that may sit on flat lab networks.

Root Cause

The sideband streaming handler does not validate that pointer-like fields embedded in the Moniker message refer to memory owned by the server before dereferencing them. There is no bounds check, type tag verification, or handle-to-pointer translation layer to constrain the values supplied by the gRPC client.

Attack Vector

An unauthenticated attacker with network reachability to the gRPC device server crafts a Moniker protobuf containing pointer values that target memory of interest. The attacker submits the message through the sideband streaming API. The server deserializes the message and dereferences the supplied pointer, giving the attacker an arbitrary read or write that can be chained into remote code execution under the privileges of the server process.

No verified public proof-of-concept code is available. Refer to the GitHub Security Advisory for vendor-provided technical detail.

Detection Methods for CVE-2026-48137

Indicators of Compromise

Unexpected crashes, restarts, or access violations in the ni_grpc_device_server process
Inbound gRPC connections to the NI sideband streaming endpoint from hosts outside the engineering or test network segment
Child processes spawned by the NI gRPC device server that are not part of normal instrument control workflows

Detection Strategies

Inspect process telemetry for the NI gRPC device server faulting on memory access, which is consistent with attempted untrusted pointer dereference
Alert on new outbound network connections, shell creation, or script interpreters launched from the NI gRPC device server process tree
Hunt for protobuf payloads of anomalous size or structure targeting the NI sideband streaming port

Monitoring Recommendations

Forward endpoint and network telemetry from systems running NI grpc-device or InstrumentStudio to a central analytics platform
Track NI gRPC device server versions across the fleet and flag any host still running 2.17.0 or earlier
Baseline normal gRPC client sources for each device server and alert on deviations

How to Mitigate CVE-2026-48137

Immediate Actions Required

Upgrade NI grpc-device server to the fixed version listed in the NI security advisory
Update NI InstrumentStudio to a release later than 2026 Q2 once available from NI
Restrict network exposure of the NI gRPC device server to trusted automation hosts only
Audit lab and OT network segmentation to ensure test instrumentation is not reachable from general user VLANs

Patch Information

NI has published fixed builds and guidance through the NI Software Security Updates portal and the GitHub Security Advisory GHSA-ww59-ghm9-mm63. Upgrade past grpc-device 2.17.0 to remediate the untrusted pointer dereference.

Workarounds

Block inbound access to the NI gRPC device server port at the host firewall except from explicitly authorized automation controllers
Place test systems on an isolated VLAN with no route to user workstations or the internet
Disable the NI gRPC device server on hosts that do not require remote instrument control until patching is complete

bash

# Example: restrict the NI grpc-device listener to trusted automation hosts on Windows
netsh advfirewall firewall add rule name="NI grpc-device allow trusted" ^
  dir=in action=allow protocol=TCP localport=31763 ^
  remoteip=10.20.30.0/24
netsh advfirewall firewall add rule name="NI grpc-device block other" ^
  dir=in action=block protocol=TCP localport=31763