EUVD-2026-33991
GHSA-5rw2-422p-gwxr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local user account on NI host
-
DeliveryOpen NI-PAL device interface
-
ExploitIssue crafted IOCTL with malformed pointer
-
ExecutionKernel dereferences NULL in driver
-
ImpactHost panics and reboots
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Attacker must already hold a local authenticated session (any privilege level able to open the NI-PAL device interface) on a Windows or Linux host with NI-PAL 26.3.0 or earlier installed - typically systems running NI-DAQmx, LabVIEW, NI-VISA, or related measurement software. No user interaction by another party is required, and no special non-default configuration is needed beyond having NI-PAL loaded as a kernel driver, which is the default when any consuming NI product is installed. Exploitation is LIMITED to denial of service (host crash) - there is no path to code execution, privilege escalation, or data disclosure from this bug alone, and the network attack surface is zero since AV:L requires local access. |
| Impact | The CVSS 7.1 base score reflects a local-only attack vector (AV:L) with low complexity (AC:L) requiring low-privilege authenticated access (PR:L) and no user interaction (UI:N), producing high integrity and availability impact but no confidentiality loss - consistent with a kernel crash triggered through a driver interface. There is no EPSS score, KEV listing, or public POC in the provided intelligence, so real-world exploitation pressure appears low and opportunistic rather than targeted. The practical risk is concentrated in environments where NI-PAL runs on multi-tenant or shared hosts (test benches, lab automation servers, industrial control workstations) - in those contexts a logged-in low-privilege user can reliably down the box, which is meaningful for availability-sensitive deployments even if the attack does not yield code execution or data theft. Note: the description states 'local authenticated user' which aligns cleanly with the CVSS PR:L vector; no signals conflict. |
| Exploit ScenarioDerived | A low-privilege user logged into a lab workstation or shared test-automation server running NI-DAQmx or LabVIEW opens the NI-PAL device interface and issues a crafted IOCTL containing a malformed or NULL pointer field, causing the kernel driver to dereference invalid memory and panic the host. The result is a full system crash (BSOD on Windows, kernel oops on Linux), halting any in-progress measurements, data acquisition runs, or automation sequences and requiring a hard reboot. No public exploit identified at time of analysis, but the bug class is straightforward to trigger once the vulnerable IOCTL path is identified. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 02, 2026
Local denial of service in NI's NI-PAL kernel driver (versions 26.3.0 and prior on Windows and Linux) allows an authenticated local user to crash the host system by sending malformed input that triggers a NULL pointer dereference in kernel space. No public exploit identified at time of analysis, but the kernel-level impact means a successful trigger takes down the entire host, not just the driver process. The issue is vendor-disclosed by NI with an advisory published on ni.com.
RemediationAI
Patch available per vendor advisory - consult the NI security bulletin at https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/2026/invalid-input-validation-vulnerabilities-in-ni-pal.html for the fixed NI-PAL build and apply it via NI Package Manager or the platform's standard update mechanism on every Windows and Linux host running NI software. Until patching is complete, restrict interactive and remote login access to systems running NI-PAL to trusted operators only (the vulnerability requires a local authenticated session), and on shared lab or test-rig hosts consider removing non-essential user accounts or enforcing dedicated single-user operation; note this reduces flexibility for multi-team labs. As a defense-in-depth measure, ensure crash dumps are collected and monitored so any exploitation attempt is detected, and rebuild/reboot procedures are documented since recovery requires a full host restart.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
NI-PAL (NI Platform Abstraction Layer) is a low-level kernel-mode component distributed by National Instruments that provides hardware abstraction services used by NI's measurement, automation, and DAQ software stacks on both Windows and Linux. Because it runs as a kernel driver, input passed from user-mode (typically via IOCTL or device-file interfaces) crosses a privilege boundary and must be rigorously validated. The root cause is CWE-476 (NULL Pointer Dereference): the driver fails to validate a pointer field - likely an input buffer, handle, or structure member supplied from user space - before dereferencing it inside the kernel, producing a kernel-mode fault (BSOD on Windows, kernel oops/panic on Linux). The CPE cpe:2.3:a:ni:ni-pal:*:*:*:*:*:*:*:* covers all NI-PAL builds up to and including 26.3.0.
Know when Ni Pal gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Primary rating from Vendor (NI) · only source for this CVE.
CVSS VectorVendor: NI
Lifecycle Timeline
3DescriptionCVE.org
Improper input validation in the NI-PAL kernel driver may allow a local authenticated user to cause a denial of service by triggering a crash due to a NULL pointer dereference. This vulnerability affects NI-PAL 26.3.0 and prior versions on Windows and Linux.
Executive ViewAI
NI's NI-PAL kernel driver (versions 26.3.0 and prior) contains a local denial-of-service vulnerability that allows authenticated users to crash the entire host system through a kernel-level NULL pointer dereference. Organizations running this driver on Windows or Linux systems face system unavailability risk from insider threats or users with local system access, with no vendor patch currently available.
Restrict local system access to trusted personnel only; implement application-level monitoring for abnormal driver interactions; enforce strict access controls for physical and console access to systems; monitor NI's security advisories daily for patch releases; consider isolating critical systems if business continuity would be severely impacted by host unavailability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Local privilege escalation in the NI-PAL kernel driver allows a low-privileged authenticated Windows user to escalate to
Local privilege escalation in National Instruments NI-PAL versions 26.3.0 and earlier on Windows and Linux allows authen
Improper input validation in the National Instruments NI-PAL driver in versions 20.0.0 and prior may allow a privileged
Exploit-DB