NI-PAL EUVD-2026-33992

Exploitation requires the attacker to already have a local authenticated session on a Windows or Linux host that has NI-PAL 26.3.0 or earlier installed and running (PR:L, AV:L in the CVSS vector), and to be able to invoke the vulnerable NI-PAL interface from that session - meaning a normal interactive user, RDP/SSH session, or any code running in a low-privileged process context on a system with NI software deployed is sufficient. No user interaction by another party is required (UI:N) and attack complexity is low (AC:L), so no race condition, special timing, or non-default configuration is needed beyond having NI-PAL installed. Exploitation is LIMITED by the need for prior code execution or shell access on the target host, by the absence of any network-facing vector, and by the fact that hosts without NI software (which is specialized engineering/lab tooling, not general-purpose) are not exposed at all.

Signals are internally consistent and point to a credible but bounded risk. The CVSS 4.0 vector confirms local attack vector (AV:L), low complexity (AC:L), low privileges required (PR:L), and no user interaction (UI:N), with high confidentiality and integrity impact (VC:H/VI:H) but no availability impact (VA:N) and no scope/subsequent system impact - consistent with an arbitrary memory read primitive that an attacker would chain into privilege escalation rather than a direct RCE. There is no EPSS score, no CISA KEV listing, and no public POC at time of analysis, so this is not a 'patch tonight' issue at the level of a remote unauthenticated bug; however, NI-PAL is widely installed on engineering, lab, and OT/ICS workstations where any local-to-SYSTEM/root primitive is significant for lateral movement and persistence. Missing data to note: no EPSS value is provided and the vendor advisory link is the sole reference, so independent corroboration of the fixed version and exploitation status is limited to NI's own bulletin.

A standard-user account on a lab or engineering workstation that has NI software installed invokes the NI-PAL interface with a crafted index/offset parameter, causing the privileged NI-PAL component to read attacker-chosen system memory and return its contents to the unprivileged caller. The attacker uses the leaked kernel pointers, SYSTEM/root process tokens, or credential material to escalate to administrative privileges on the host, then pivots into the broader lab or OT network. No public exploit code has been identified at time of analysis, but the bug class (CWE-1285 arbitrary read) is well understood and routinely weaponized once a vulnerable IOCTL or service entry point is located.