NI grpc-device CVE-2026-48137

Exploitation requires that the NI grpc-device server (version 2.17.0 or earlier) be running and that its gRPC sideband streaming API be reachable from the attacker's network position; the attacker must be able to send a specially crafted Moniker protobuf message to that endpoint. Per the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N), no authentication, user interaction, or special attack requirements are needed, and the default-configured network listener is the attack surface. Realistic limiting factor: grpc-device is typically deployed inside controlled measurement/lab networks rather than on the public internet, so practical exposure is gated by whether the gRPC port is reachable to the attacker - anyone with that reachability and the ability to send a TCP/gRPC payload can attempt exploitation, and InstrumentStudio installations that bundle grpc-device may expose the same surface unintentionally.

Multiple signals point to this being a real priority for any environment exposing grpc-device: the CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N with VC:H/VI:H gives a 9.3 base score, meaning network-reachable, no authentication, no user interaction, and high confidentiality+integrity impact (availability scored N, likely because the primary outcome is memory corruption leading to code execution rather than guaranteed crash). The vulnerability is not currently listed in CISA KEV and no EPSS score was provided, and no public exploit has been identified at time of analysis, which tempers the immediate exploitation likelihood - however, the prerequisite (a crafted protobuf message to a network-exposed gRPC endpoint) is low-effort to develop once the message format is reverse-engineered from the open-source ni/grpc-device repository. Net assessment: high-severity and trivially weaponizable in principle, but real-world exposure depends heavily on whether the grpc-device server is exposed beyond a trusted lab network - many deployments are isolated, which substantially limits realistic attack surface.

An attacker with network reachability to a measurement workstation running NI grpc-device 2.17.0 connects to the gRPC sideband streaming endpoint and sends a crafted Moniker protobuf message whose internal identifier fields encode an attacker-chosen pointer value. The server deserializes the message and dereferences the supplied pointer without validation, enabling memory corruption that is shaped into arbitrary code execution in the context of the grpc-device service. No public exploit identified at time of analysis, but the protocol definitions are open source in the ni/grpc-device repository, lowering the barrier to weaponization.