EUVD-2026-38022Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote unauthenticated crafted gRPC request with no user interaction (AV:N/AC:L/PR:N/UI:N); vendor describes DoS only, so C:N/I:N/A:H and no scope change.
Primary rating from Vendor (NI).
CVSS VectorVendor: NI
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
5DescriptionCVE.org
There is an out-of-bounds read vulnerability in the NI grpc-device streaming API due to a missing bounds check that may result in a denial of service. Successful exploitation requires an attacker to supply a specially crafted write request. This affects NI grpc-device 2.17.0 and prior versions.
AnalysisAI
Remote denial of service in NI grpc-device 2.17.0 and earlier allows unauthenticated network attackers to crash the streaming API by sending a specially crafted write request that triggers an out-of-bounds read (CWE-125). The flaw was reported by NI itself and is documented in both an NI security bulletin and a GitHub security advisory (GHSA-8rjh-429j-f6gw); no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Technical ContextAI
NI grpc-device is National Instruments' gRPC-based server that exposes instrument-control drivers over the network so remote clients can drive test-and-measurement hardware via NI-VISA, NI-DAQmx, and similar libraries - it is also embedded in the InstrumentStudio workflow (both CPEs are listed). The vulnerability is a CWE-125 out-of-bounds read in the streaming write path: a missing bounds check on attacker-controlled length or offset metadata in a write request causes the server to read past the end of an in-process buffer, terminating the gRPC process. Because gRPC streaming relies on length-prefixed framed messages, any field that drives memory access without validation is a classic source of this bug class.
RemediationAI
Upstream fix available per the GitHub security advisory GHSA-8rjh-429j-f6gw and NI's security bulletin; the released patched version is not independently confirmed from the data provided, so consult https://github.com/ni/grpc-device/security/advisories/GHSA-8rjh-429j-f6gw and https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/2026/multiple-vulnerabilities-in-ni-grpc-device-server.html for the exact post-2.17.0 release to upgrade to. Until the patched build is deployed, restrict network access to the grpc-device server port so only trusted automation hosts on the lab/test network can reach it (firewall ACLs or host-based filtering) - the trade-off is that any remote test-orchestration client outside that allowlist will lose connectivity. Where feasible, place the server behind a mutually authenticated TLS reverse proxy or VPN to remove unauthenticated reachability entirely, accepting added latency and configuration overhead; disabling the streaming write API as a workaround is not advised because it is core to instrument control and will break legitimate measurement workflows.
More in Grpc Device
View allRemote code execution in NI grpc-device 2.17.0 and earlier is possible when an attacker sends a specially crafted Monike
Unauthenticated network access to NI grpc-device 2.17.0 and earlier is possible when the server is deployed without TLS
Denial of service in NI grpc-device 2.17.0 and prior allows remote unauthenticated attackers to crash the data moniker s
Denial of service in NI grpc-device 2.17.0 and earlier allows an authenticated remote attacker to crash or destabilize t
Silent integer truncation in NI grpc-device 2.17.0 and earlier allows unauthenticated network-accessible attackers to co
Memory exhaustion denial of service in NI grpc-device's BeginSidebandStream RPC endpoint allows authenticated network at
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today