Skip to main content

NI grpc-device CVE-2026-48141

| EUVDEUVD-2026-38029 MEDIUM
Memory Leak (CWE-401)
2026-06-19 NI
Denial Of Service Grpc Device Instrumentstudio
6.0
CVSS 4.0 · Vendor: NI
Share

Severity by source

Vendor (NI) PRIMARY
6.0 MEDIUM
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
5.3 MEDIUM

Network-reachable via gRPC but requires authenticated low-privilege access and specific repeated invocation patterns; impact is solely availability of the grpc-device service.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (NI).

CVSS VectorVendor: NI

CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

2
Analysis Generated
Jun 19, 2026 - 14:28 vuln.today
CVSS changed
Jun 19, 2026 - 14:22 NVD
5.3 (MEDIUM) 6.0 (MEDIUM)

DescriptionCVE.org

There is a memory leak in NI grpc-device BeginSidebandStream that may result in denial of service due to memory exhaustion.  This affects NI grpc-device 2.17.0 and prior versions.

AnalysisAI

Memory exhaustion denial of service in NI grpc-device's BeginSidebandStream RPC endpoint allows authenticated network attackers to crash or destabilize the server by triggering a cumulative memory leak with each invocation. All versions of NI grpc-device up to and including 2.17.0 are affected, along with NI InstrumentStudio as a dependent product. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Obtain low-privilege credentials for grpc-device server
Delivery
Connect to gRPC endpoint over network
Exploit
Repeatedly invoke BeginSidebandStream RPC without releasing streams
Execution
Memory accumulates per call without reclamation
Persist
Server process exhausts available system memory
Impact
grpc-device service crashes or becomes unresponsive, denying service to all clients
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires authenticated network access to the NI grpc-device gRPC server - the CVSS 4.0 vector specifies PR:L, confirming low-privilege authentication is a mandatory prerequisite; unauthenticated exploitation is not supported by available data. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H) scores 6.0, reflecting a network-reachable flaw with high availability impact but constrained by two key mitigating factors: authenticated low-privilege access is required (PR:L), and attack complexity is high (AC:H), indicating exploitation is not trivially reproducible and likely demands specific knowledge of invocation patterns or timing to reliably exhaust memory. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An authenticated low-privilege user or compromised client application with access to the NI grpc-device gRPC endpoint repeatedly calls BeginSidebandStream without completing the stream lifecycle, causing the server process to accumulate unreleased memory allocations. Sustained over time or at high call rate, available system memory is exhausted, causing the grpc-device server to crash or become unresponsive and disrupting all connected measurement clients and automated test workflows. …
Remediation The primary remediation is to upgrade NI grpc-device to a version beyond 2.17.0 per vendor guidance. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Grpc Device

View all
CVE-2026-48137 CRITICAL
9.3 Jun 19

Remote code execution in NI grpc-device 2.17.0 and earlier is possible when an attacker sends a specially crafted Monike
CVE-2026-9142 CRITICAL
9.3 Jun 19

Unauthenticated network access to NI grpc-device 2.17.0 and earlier is possible when the server is deployed without TLS

CVE-2026-48139 HIGH
8.7 Jun 19

Denial of service in NI grpc-device 2.17.0 and prior allows remote unauthenticated attackers to crash the data moniker s
CVE-2026-48138 HIGH
8.7 Jun 19

Remote denial of service in NI grpc-device 2.17.0 and earlier allows unauthenticated network attackers to crash the stre
CVE-2026-48140 HIGH
7.1 Jun 19

Denial of service in NI grpc-device 2.17.0 and earlier allows an authenticated remote attacker to crash or destabilize t
CVE-2026-9143 MEDIUM
6.3 Jun 19

Silent integer truncation in NI grpc-device 2.17.0 and earlier allows unauthenticated network-accessible attackers to co

Same weakness CWE-401 – Memory Leak

View all
CVE-2025-56353 HIGH POC
7.5
CVE-2026-50254 HIGH
8.7
CVE-2026-35505 HIGH
8.7
CVE-2026-3650 HIGH
8.7
CVE-2025-26311 MEDIUM POC
6.5
CVE-2025-25469 MEDIUM POC
6.5
CVE-2025-26308 MEDIUM POC
6.5
CVE-2025-26307 MEDIUM POC
6.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2014-1761 HIGH POC
7.8
CVE-2011-0609 HIGH POC
7.8
CVE-2013-3163 HIGH POC
8.8
CVE-2014-1776 CRITICAL POC
9.8

Share

CVE-2026-48141 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy