Which versions of NI grpc-device are affected by CVE-2026-48140?

NI grpc-device versions 2.17.0 and earlier are vulnerable to authenticated denial-of-service attacks that crash the gRPC server, disrupting operational continuity for research, manufacturing, and…

How to fix or mitigate CVE-2026-48140?

Within 24 hours: Inventory all systems running NI grpc-device 2.17.0 or earlier and document network access paths to these services. Within 7 days: Deploy firewall rules or network segmentation restricting gRPC server access to authorized systems and administrators only; enable audit logging on BeginSidebandStream message processing. Within 30 days: Establish a vendor communication program to track NI security advisories, test patches when released, and plan upgrade timeline to versions beyond 2.17.0.

NI grpc-device CVE-2026-48140

Q: What is the CVSS score of CVE-2026-48140?

CVE-2026-48140 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-38028 HIGH

Incorrect Type Conversion or Cast (CWE-704)

2026-06-19 NI

Denial Of Service Grpc Device Instrumentstudio

7.1

CVSS 4.0 · Vendor: NI

Severity by source

Vendor (NI) PRIMARY

7.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network-reachable gRPC RPC (AV:N) with trivial crafted payload (AC:L) requires authenticated low-privileged caller (PR:L), no UI, scope unchanged, availability-only impact from server crash.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (NI).

CVSS VectorVendor: NI

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 19, 2026 - 14:27 vuln.today

Severity Changed

Jun 19, 2026 - 14:22 NVD

MEDIUM HIGH

CVSS changed

Jun 19, 2026 - 14:22 NVD

6.5 (MEDIUM) 7.1 (HIGH)

DescriptionCVE.org

There is an unchecked enum cast vulnerability in NI grpc-device BeginSidebandStream that may allow an attacker to trigger invalid enum states and undefined behavior, potentially resulting in a denial of service. Successful exploitation requires an attacker to supply a specially crafted message containing an out-of-range value. This affects NI grpc-device 2.17.0 and prior versions.

AnalysisAI

Denial of service in NI grpc-device 2.17.0 and earlier allows an authenticated remote attacker to crash or destabilize the gRPC server by sending a crafted BeginSidebandStream message containing an out-of-range enum value. The unchecked cast triggers undefined behavior in the server process, with no public exploit identified at time of analysis. The flaw is reported by the vendor and tracked under GHSA-prfr-q8h3-mqxv.

Technical ContextAI

NI grpc-device is National Instruments' gRPC server that exposes hardware instrument control APIs (NI-DAQmx, NI-VISA, etc.) over the network, commonly used alongside NI InstrumentStudio for distributed test and measurement deployments. The BeginSidebandStream RPC accepts a protobuf message containing an enumerated field that is cast to a native C++ enum without bounds validation, the classic CWE-704 (Incorrect Type Conversion or Cast) pattern. When a value outside the declared enum range is supplied, the resulting enum object holds an undefined value, which can drive switch/case branching off a valid code path and produce undefined behavior, including process termination. CPEs cpe:2.3:a:ni:grpc-device and cpe:2.3:a:ni:instrumentstudio confirm both server and bundled-tooling exposure.

RemediationAI

Upgrade NI grpc-device to a version later than 2.17.0 per the NI security bulletin at https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/2026/multiple-vulnerabilities-in-ni-grpc-device-server.html and the upstream advisory at https://github.com/ni/grpc-device/security/advisories/GHSA-prfr-q8h3-mqxv; the input data lists patch availability but does not pin a single fixed version, so consult those advisories for the exact build to deploy (patch available per vendor advisory). As compensating controls until patching, restrict network access to the grpc-device TLS/HTTP2 listener via firewall ACLs so only known instrument-control clients can reach it, enforce mutual TLS or strong session authentication on the gRPC endpoint to raise the bar above the PR:L threshold, and place the server on an isolated test-bench VLAN - the trade-off is reduced flexibility for ad-hoc remote engineers and the need to manage allowlists or client certificates. Reviewing InstrumentStudio installations for bundled vulnerable grpc-device binaries is also recommended since the same CPE is flagged.