NI-PAL CVE-2026-18485

Exploitation requires a valid low-privileged local user session on a Windows host where NI-PAL 26.3.1 or an earlier version is installed and the kernel driver is loaded - the CVSS 4.0 vector PR:L confirms low-privileged authentication is sufficient and no user interaction is needed (UI:N). The attack is strictly local (AV:L); no network-facing vector exists. Exploitation is limited to Microsoft Windows; no other platforms are affected. No special application configuration or non-default setting is required beyond the NI-PAL driver being present and running, which is standard for any NI software installation. The primary limiting factors are the requirement for an existing local Windows account and physical or remote desktop access to the target system.

The CVSS 4.0 score of 8.5 is grounded in a local attack vector (AV:L), low complexity (AC:L), no attack requirements (AT:N), low privilege entry (PR:L), no user interaction (UI:N), and full CIA impact on the vulnerable system (VC:H/VI:H/VA:H) with no scope change to downstream systems (SC:N/SI:N/SA:N). The local vector is the primary risk moderator - an attacker must already hold a valid Windows logon, ruling out internet-facing exploitation. No EPSS score was provided in the source data, so probabilistic exploitation likelihood cannot be quantified. The vulnerability is absent from the CISA KEV catalog and no POC is publicly known, reducing urgency relative to actively exploited equivalents. However, NI test and measurement environments frequently operate shared Windows workstations in lab settings with multiple user accounts, making the local-access prerequisite less protective than it would be on tightly controlled single-user systems. Real-world priority is moderate for NI-deployed environments and low for organizations that do not use NI software.

A low-privileged domain user with an interactive Windows session on a machine running NI software (and thus NI-PAL 26.3.1 or earlier) opens a handle to the NI-PAL kernel driver and sends a crafted IOCTL request containing an out-of-bounds index or offset. The driver fails to validate the input per CWE-1285, triggering a kernel memory corruption primitive that the attacker leverages to overwrite their process security token and elevate to SYSTEM. No public POC is known at this time, limiting exploitation to actors with kernel driver exploitation expertise.