CVE-2026-48137 is an untrusted pointer dereference in the NI grpc-device sideband streaming API, scored CVSS 9.1 (critical). A crafted Moniker protobuf message can cause an arbitrary memory dereference and may lead to remote code execution. It affects version 2.17.0 and earlier. Upgrade to 2.18.0.
What's affected
The GitHub advisory says grpc-device 2.17.0 and earlier are affected and that 2.18.0 or later is the fix. It lists no other workaround.
The NVD record lists two products: NI InstrumentStudio and the NI grpc-device server (ni_grpc_device_server). The advisory rates the issue Critical with a CVSS v4 score of 9.3, and the NVD record scores it 9.1 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N.
NI also publishes a security page for the grpc-device server. It is the place to confirm which NI product bundles are affected.
How to check if you're exposed
- If you run the server from source or a release package, find the version. Check the release tag you deployed or the package listing from NI Package Manager.
- Check which NI products installed the grpc-device server on a test station. InstrumentStudio is named in the record.
- Look at where the server listens. Test automation stations often expose gRPC ports on a lab network.
- Compare with the affected range, 2.17.0 and earlier, and the fixed version, 2.18.0.
If you do not know whether the server is installed, search test stations for the executable name ni_grpc_device_server.
What to do now
- Inventory the machines that run the NI grpc-device server and note their versions.
- Upgrade to 2.18.0 or later, using the NI security page for product specific guidance.
- Limit network access to the server's gRPC port to the clients that need it, for example with host firewall rules.
- Keep test stations off general user networks.
- Record the version in your asset list so future NI advisories are easy to match.
Why it matters
The weakness is CWE-822, untrusted pointer dereference. The advisory describes software that accepts a value from an untrusted source, treats it as a pointer and dereferences it. Anything that can send a crafted Moniker protobuf message can steer where the server reads or writes memory, which may lead to code execution.
Lab and test equipment networks are often treated as safe because they are internal. A server that accepts network messages and acts on memory addresses inside them should not rely on that. The record's KEV flag is false.
Quick check
Is CVE-2026-48137 exploited in the wild?
The record's KEV flag is false, and the pages I read do not say it is exploited. Treat it as a patch item and keep an eye on the advisory for changes.
Is a firewall enough?
It reduces exposure but does not fix the flaw. The advisory's remedy is to upgrade to 2.18.0 or later.
Sources
Last reviewed: 19 October 2026.
