CVE-2026-9143 Overview
CVE-2026-9143 is an incorrect conversion between numeric types vulnerability affecting National Instruments (NI) grpc-device server versions 2.17.0 and prior. The flaw originates in the CodeGen component, which lacks proper range checks when converting size values between numeric types. When a size value exceeds the target type's representable range, high-order bits are silently discarded, leading to truncation. This numeric truncation can cause downstream logic to operate on values that differ from those supplied by a remote client, producing integrity issues over the gRPC interface.
Critical Impact
Remote, unauthenticated attackers can exploit numeric truncation in NI grpc-device CodeGen to corrupt size-dependent operations, affecting data integrity in instrument control workflows.
Affected Products
- NI grpc-device server versions 2.17.0 and prior
- NI InstrumentStudio 2026 Q1
- NI InstrumentStudio 2026 Q2
Discovery Timeline
- 2026-06-19 - CVE-2026-9143 published to NVD
- 2026-06-25 - Last updated in NVD database
Technical Details for CVE-2026-9143
Vulnerability Analysis
The vulnerability is classified under [CWE-681] Incorrect Conversion Between Numeric Types. NI grpc-device uses a CodeGen subsystem to generate service handlers that bridge gRPC requests to underlying instrument driver APIs. The generated code passes size values across types of differing widths without validating that the source value fits within the destination type. When a remote caller supplies a size that exceeds the target type's maximum, the conversion silently discards the high bits rather than rejecting the input or raising an error.
This truncation breaks the relationship between the requested size and the size that downstream code actually processes. Logic that depends on the original value, such as buffer allocation tracking, iteration counts, or parameter passing into driver APIs, operates on the truncated value. The result is an integrity impact on operations that rely on consistent size handling between the gRPC layer and the underlying instrument logic.
Root Cause
The CodeGen templates emit numeric conversions without bounds-checking the source value against the target type's range. No validation guards exist before assignment between integer types of different widths, so any oversized size parameter is accepted and silently truncated.
Attack Vector
Exploitation requires network access to the grpc-device server endpoint and no authentication. An attacker crafts a gRPC request containing a size field whose value exceeds the target type's range. The server accepts the request, truncates the value during conversion, and proceeds with the truncated size. Attack complexity is high because the attacker must identify size fields that flow through vulnerable conversions and craft inputs that yield exploitable post-truncation values.
No verified exploitation code is publicly available. Refer to the GitHub Security Advisory GHSA-rhh6-fvjv-8m84 for vendor-supplied technical details.
Detection Methods for CVE-2026-9143
Indicators of Compromise
- gRPC requests to NI grpc-device server containing size or length fields with values near or exceeding 32-bit or 16-bit integer boundaries.
- Unexpected instrument behavior or driver errors following gRPC calls that include unusually large size parameters.
- Server logs showing successful request handling immediately preceded by anomalously large numeric inputs.
Detection Strategies
- Inspect gRPC traffic to NI grpc-device endpoints for size fields outside expected operational ranges.
- Correlate instrument control errors with the source gRPC client and the size parameters in recent requests.
- Validate that grpc-device server version reported by deployed hosts is later than 2.17.0.
Monitoring Recommendations
- Log all gRPC requests to NI grpc-device with full parameter values for offline analysis.
- Monitor network egress and ingress to ports hosting the grpc-device service for unauthenticated remote connections.
- Alert on any new client identities establishing sessions with grpc-device servers in lab or production OT segments.
How to Mitigate CVE-2026-9143
Immediate Actions Required
- Upgrade NI grpc-device server to a version later than 2.17.0 per the vendor advisory.
- Restrict network access to the grpc-device service to trusted management hosts using firewall rules or segmentation.
- Audit InstrumentStudio 2026 Q1 and Q2 deployments and apply the corresponding NI security update.
Patch Information
NI has published remediation guidance in the NI Security Update for grpc-device server vulnerabilities and the GitHub Security Advisory GHSA-rhh6-fvjv-8m84. Apply the fixed grpc-device release and corresponding InstrumentStudio update on all affected hosts.
Workarounds
- Place grpc-device servers behind a network ACL that permits only known engineering workstations.
- Disable the grpc-device service on hosts that do not require remote instrument control.
- Where feasible, terminate gRPC connections through a proxy that enforces strict input size limits on size and length fields.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
