CVE-2026-48138: NI InstrumentStudio DOS Vulnerability

CVE-2026-48138 Overview

CVE-2026-48138 is an out-of-bounds read vulnerability in the National Instruments (NI) grpc-device streaming API. The flaw stems from a missing bounds check that allows an attacker to trigger a denial of service condition by sending a specially crafted write request. The vulnerability affects NI grpc-device version 2.17.0 and earlier, as well as NI InstrumentStudio releases that bundle the affected gRPC device server.

The issue is classified under [CWE-125: Out-of-bounds Read] and is exploitable remotely over the network without authentication or user interaction.

Critical Impact
A remote, unauthenticated attacker can crash the NI grpc-device server by submitting a malformed write request, disrupting instrument control and measurement workflows.

Affected Products

NI grpc-device 2.17.0 and prior versions
NI InstrumentStudio 2026 Q1
NI InstrumentStudio 2026 Q2

Discovery Timeline

2026-06-19 - CVE-2026-48138 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-48138

Vulnerability Analysis

The grpc-device project from NI exposes a gRPC interface that proxies remote procedure calls to National Instruments hardware drivers. The streaming API supports write operations that accept caller-supplied buffers and length fields used to copy data into driver-bound structures.

The vulnerable code path processes a streaming write request without verifying that the requested read length stays within the bounds of the supplied buffer. When the server iterates over the buffer to forward data to the underlying device driver, it reads past the allocated region. This out-of-bounds read produces undefined behavior and typically terminates the server process, denying service to all connected clients.

Because the gRPC server commonly runs as a long-lived service on lab and test bench systems, a crash interrupts ongoing measurements and forces operator intervention to restart the service.

Root Cause

The root cause is a missing bounds check in the streaming write request handler. The handler trusts a length value derived from the request payload and uses it to access memory without confirming the value falls within the allocated buffer. This is a classic [CWE-125] pattern where input-controlled offsets reach memory read primitives directly.

Attack Vector

The attack vector is network based and requires no privileges or user interaction. An attacker with network reachability to the gRPC endpoint sends a crafted write request containing a length field that exceeds the buffer size. The malformed request is sufficient to trigger the out-of-bounds read and crash the server. Refer to the GitHub Security Advisory GHSA-8rjh-429j-f6gw for additional technical context.

Detection Methods for CVE-2026-48138

Indicators of Compromise

Unexpected termination or repeated restarts of the ni_grpc_device_server process on test and measurement hosts.
gRPC client errors such as UNAVAILABLE or connection resets correlated with inbound streaming write requests.
Crash dumps or Windows Application Event Log entries referencing access violations in the NI grpc-device server binary.

Detection Strategies

Monitor process lifecycle telemetry for the ni_grpc_device_server service and alert on abnormal exit codes.
Inspect gRPC traffic to the device server port for write requests with length fields that exceed expected payload sizes.
Correlate server crashes with the source IP of recent gRPC client connections to identify malicious senders.

Monitoring Recommendations

Log all inbound connections to the NI grpc-device port and restrict access to known automation hosts.
Forward server crash events and gRPC error rates to a centralized SIEM for trend analysis.
Baseline normal request sizes for the streaming API so that anomalous oversized writes can be flagged.

How to Mitigate CVE-2026-48138

Immediate Actions Required

Upgrade NI grpc-device to a version later than 2.17.0 as published in the vendor advisory.
Update NI InstrumentStudio to a release that ships the patched grpc-device server.
Restrict network exposure of the grpc-device port to trusted measurement clients only.
Audit logs for prior crashes that may indicate exploitation attempts against the streaming API.

Patch Information

NI has published fixes and guidance through the NI Security Update Analysis and the GitHub Security Advisory GHSA-8rjh-429j-f6gw. Apply the vendor-supplied update to address the missing bounds check in the streaming write handler.

Workarounds

Place the grpc-device server behind a network segment or firewall that blocks untrusted hosts from reaching the gRPC port.
Disable the grpc-device service on systems that do not require remote instrument access until the patch is applied.
Require mutual TLS authentication on the gRPC channel where supported to limit which clients can submit requests.

bash

# Example host-based firewall rule restricting access to the NI grpc-device port
# Replace <trusted_subnet> and <grpc_port> with environment-specific values
netsh advfirewall firewall add rule name="NI grpc-device allow trusted" \
    dir=in action=allow protocol=TCP localport=<grpc_port> \
    remoteip=<trusted_subnet>
netsh advfirewall firewall add rule name="NI grpc-device block other" \
    dir=in action=block protocol=TCP localport=<grpc_port>