NI grpc-device EUVD-2026-38029

Exploitation requires authenticated network access to the NI grpc-device gRPC server - the CVSS 4.0 vector specifies PR:L, confirming low-privilege authentication is a mandatory prerequisite; unauthenticated exploitation is not supported by available data. The BeginSidebandStream RPC endpoint must be reachable on the network (AV:N). The AC:H metric indicates high attack complexity, meaning the leak trigger is not a single-call crash but likely requires sustained or patterned invocation to produce observable memory exhaustion. Exploitation is therefore limited to actors who possess valid credentials and have sufficient knowledge of the streaming protocol to repeatedly invoke the vulnerable code path. Anonymous or external-internet exploitation without credentials is not supported by the CVSS vector. Environments that restrict grpc-device access to localhost or a tightly controlled management VLAN with strong authentication materially reduce exploitability.

The CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H) scores 6.0, reflecting a network-reachable flaw with high availability impact but constrained by two key mitigating factors: authenticated low-privilege access is required (PR:L), and attack complexity is high (AC:H), indicating exploitation is not trivially reproducible and likely demands specific knowledge of invocation patterns or timing to reliably exhaust memory. Confidentiality and integrity are unaffected, so risk is scoped entirely to service availability. No EPSS score is available in the provided data, precluding probabilistic exploitation comparison. The vulnerability is absent from CISA KEV and no public proof-of-concept code has been identified, making opportunistic mass exploitation unlikely at this time. For organizations operating NI grpc-device in test and measurement environments - particularly where the gRPC port is network-accessible to multiple authenticated users or automated clients - this represents a moderate, targeted DoS risk rather than a critical priority. The high complexity rating should not be dismissed; it is an assessed metric, and a determined authenticated insider or compromised client could still trigger exhaustion through sustained scripted invocation.

An authenticated low-privilege user or compromised client application with access to the NI grpc-device gRPC endpoint repeatedly calls BeginSidebandStream without completing the stream lifecycle, causing the server process to accumulate unreleased memory allocations. Sustained over time or at high call rate, available system memory is exhausted, causing the grpc-device server to crash or become unresponsive and disrupting all connected measurement clients and automated test workflows. No public exploit code is currently available, and the high attack complexity suggests successful exploitation likely requires understanding of the sideband streaming protocol internals.