EUVD-2026-38022Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach grpc-device gRPC port
-
DeliveryOpen streaming write channel
-
ExploitSend crafted write request with bad bounds
-
ExecutionTrigger out-of-bounds read in parser
-
PersistCrash gRPC server process
-
ImpactHalt connected instrument operations
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the NI grpc-device server's gRPC port and the ability to send a specially crafted streaming write request - explicitly called out in the vendor description. No authentication, user interaction, or non-default configuration is required (PR:N/UI:N/AT:N), so any default deployment of grpc-device 2.17.0 or earlier exposed on a reachable interface is vulnerable. The practical limiter is network exposure: grpc-device is normally deployed inside isolated lab/test networks, so internet-exposed instances are rare; impact is bounded to availability (process crash), with no confirmed code execution or data disclosure path. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) shows a remote, unauthenticated, low-complexity attack, but the impact is constrained to availability (VA:H, VC:N, VI:N) - consistent with a crash rather than RCE or data leakage, despite the 'Information Disclosure' and 'Buffer Overflow' tags that come from generic CWE-125 classification. There is no KEV listing, no published EPSS score in the input, and no POC referenced, so this is best treated as a credible DoS risk that is real but not under active exploitation. The practical priority depends on exposure: a grpc-device server reachable from untrusted networks (anything beyond an isolated lab subnet) should be patched promptly, because the only barrier to repeated crashing is network reachability; lab-isolated deployments behind firewalls have substantially lower urgency. Note that the 'Information Disclosure' tag conflicts with the CVSS impact metrics (VC:N) - the vendor description only claims DoS, so any read of out-of-bounds memory back to the client is not confirmed by available data. |
| Exploit ScenarioDerived | An attacker on the same network as an NI grpc-device server (for example, a contractor laptop on a shared lab VLAN or an attacker who has pivoted to the test network) opens a gRPC channel and issues a crafted streaming write request with malformed length/offset metadata. The server performs an unchecked read past the buffer boundary, crashes the gRPC process, and halts all in-flight instrument operations. Repeated requests keep the test bench offline; no POC has been published at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jun 19, 2026
Remote denial of service in NI grpc-device 2.17.0 and earlier allows unauthenticated network attackers to crash the streaming API by sending a specially crafted write request that triggers an out-of-bounds read (CWE-125). The flaw was reported by NI itself and is documented in both an NI security bulletin and a GitHub security advisory (GHSA-8rjh-429j-f6gw); no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Earlier versions of this analysis (2)
Denial of service in NI grpc-device 2.17.0 and prior allows remote unauthenticated attackers to trigger an out-of-bounds read via a crafted write request to the streaming API, crashing the gRPC server process. The flaw stems from a missing bounds check (CWE-125) and is reachable over the network without user interaction; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Denial of service in NI grpc-device 2.17.0 and earlier allows remote unauthenticated attackers to crash the streaming API by sending a crafted write request that triggers an out-of-bounds read. The flaw also affects deployments of NI InstrumentStudio that bundle the grpc-device server. No public exploit is identified at time of analysis, but the network-reachable, no-privilege CVSS profile (7.5) makes any exposed instance trivially disruptable.
RemediationAI
Upstream fix available per the GitHub security advisory GHSA-8rjh-429j-f6gw and NI's security bulletin; the released patched version is not independently confirmed from the data provided, so consult https://github.com/ni/grpc-device/security/advisories/GHSA-8rjh-429j-f6gw and https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/2026/multiple-vulnerabilities-in-ni-grpc-device-server.html for the exact post-2.17.0 release to upgrade to. Until the patched build is deployed, restrict network access to the grpc-device server port so only trusted automation hosts on the lab/test network can reach it (firewall ACLs or host-based filtering) - the trade-off is that any remote test-orchestration client outside that allowlist will lose connectivity. Where feasible, place the server behind a mutually authenticated TLS reverse proxy or VPN to remove unauthenticated reachability entirely, accepting added latency and configuration overhead; disabling the streaming write API as a workaround is not advised because it is core to instrument control and will break legitimate measurement workflows.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
NI grpc-device is National Instruments' gRPC-based server that exposes instrument-control drivers over the network so remote clients can drive test-and-measurement hardware via NI-VISA, NI-DAQmx, and similar libraries - it is also embedded in the InstrumentStudio workflow (both CPEs are listed). The vulnerability is a CWE-125 out-of-bounds read in the streaming write path: a missing bounds check on attacker-controlled length or offset metadata in a write request causes the server to read past the end of an in-process buffer, terminating the gRPC process. Because gRPC streaming relies on length-prefixed framed messages, any field that drives memory access without validation is a classic source of this bug class.
Know when Grpc Device gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Remote unauthenticated crafted gRPC request with no user interaction (AV:N/AC:L/PR:N/UI:N); vendor describes DoS only, so C:N/I:N/A:H and no scope change.
Primary rating from Vendor (NI).
CVSS VectorVendor: NI
Lifecycle Timeline
1DescriptionCVE.org
There is an out-of-bounds read vulnerability in the NI grpc-device streaming API due to a missing bounds check that may result in a denial of service. Successful exploitation requires an attacker to supply a specially crafted write request. This affects NI grpc-device 2.17.0 and prior versions.
Executive ViewAI
National Instruments' grpc-device product (versions 2.17.0 and earlier) is vulnerable to remote denial-of-service attacks that allow unauthenticated network attackers to crash the streaming API, disrupting critical industrial control and measurement applications. The vulnerability scores 8.7 (CVSS) with no vendor patch currently available, creating immediate operational risk. Organizations must implement interim network protections within days to maintain service continuity.
No vendor-released patch identified at time of analysis. Interim mitigations: enforce network-level access controls and firewall rules to restrict gRPC-device connectivity to trusted systems only; implement rate limiting and connection throttling on gRPC streaming endpoints; deploy intrusion detection rules targeting malformed write requests; enable detailed logging and monitoring of gRPC service availability and error rates; evaluate operational criticality and consider disabling gRPC streaming if non-essential to core business functions.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Grpc Device
View allRemote code execution in NI grpc-device 2.17.0 and earlier is possible when an attacker sends a specially crafted Monike
Unauthenticated network access to NI grpc-device 2.17.0 and earlier is possible when the server is deployed without TLS
Denial of service in NI grpc-device 2.17.0 and prior allows remote unauthenticated attackers to crash the data moniker s
Denial of service in NI grpc-device 2.17.0 and earlier allows an authenticated remote attacker to crash or destabilize t
Silent integer truncation in NI grpc-device 2.17.0 and earlier allows unauthenticated network-accessible attackers to co
Memory exhaustion denial of service in NI grpc-device's BeginSidebandStream RPC endpoint allows authenticated network at
Exploit-DB