NI grpc-device EUVD-2026-38032

The NI grpc-device server must be network-reachable from the attacker's position, consistent with AV:N in the CVSS 4.0 vector. The vulnerability is triggered by submitting a gRPC request containing a size or length parameter whose value exceeds the range of the internal numeric target type in the CodeGen component - requiring deliberate crafting of a specific boundary-crossing value, which accounts for the AC:H complexity rating. Per the PR:N CVSS metric, no authentication credential is required to submit a gRPC request and trigger the flaw, and no user interaction is needed (UI:N). Exploitation is meaningfully limited by: the AC:H complexity requiring precise integer-overflow crafting rather than generic fuzzing; the low integrity-only impact (VI:L) with no confidentiality or availability consequences; and the requirement that the gRPC server port be externally reachable - environments that restrict the service to localhost or a trusted internal VLAN substantially reduce the realistic attack surface.

The CVSS 4.0 score of 6.3 with vector AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N reflects a moderate-risk, remotely exploitable flaw constrained by high attack complexity. The AC:H metric indicates that exploiting the truncation requires precisely crafting size values that cross integer type boundaries - this is not a trivial spray-and-pray attack and limits opportunistic exploitation. The integrity impact is rated Low (VI:L) with no confidentiality or availability impact, bounding the blast radius to data corruption rather than code execution or disclosure. Critically, the 'Information Disclosure' tag present in the intelligence data conflicts with the VC:N metric in the CVSS 4.0 vector - this discrepancy is unresolved and should be verified against the NI advisory, as it may indicate a secondary information-disclosure vector not captured in the primary CVSS scoring. No CISA KEV listing and no publicly identified proof-of-concept code exist, keeping real-world exploitation risk low at time of analysis. EPSS data was not included in the provided intelligence, so exploitation probability cannot be independently quantified. NI InstrumentStudio's presence in the CPE data broadens the potentially affected surface beyond the standalone grpc-device server. Overall, this is a genuine but lower-urgency finding compared to critical RCE or auth-bypass vulnerabilities in the same environment.

An attacker with network access to an exposed gRPC-device server constructs a gRPC message containing a size or length field set to a value exceeding the maximum of the target integer type used internally by CodeGen (for example, a value above 2^31-1 when the target is a signed 32-bit integer). The CodeGen layer converts this value without a bounds check, silently discards the high-order bits, and produces an incorrect, smaller size value that the server uses to process subsequent instrument commands or data frames. The result is silent data corruption in instrument operations - misconfigured hardware state, incorrectly sized buffers, or invalid instrument parameters - without any error signal to the client. No public proof-of-concept code has been identified at time of analysis.