CVE-2026-48141

Published: Jun 19, 2026Modified: Jun 25, 2026

6.0

Vector

CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Show more

CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: security@ni.com (Secondary)

Description

There is a memory leak in NI grpc-device BeginSidebandStream that may result in denial of service due to memory exhaustion. This affects NI grpc-device 2.17.0 and prior versions.

Affected (4)

Products: Ni: Instrumentstudio, Ni Grpc Device Server

2 products

Instrumentstudio

Ni Grpc Device Server

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Ni Instrumentstudio	Up to 2025
Ni Instrumentstudio	Version 2026 q1
Ni Instrumentstudio	Version 2026 q2

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Ni Ni Grpc Device Server	Before 2.18.0

Related CWEs

Missing Release of Memory after Effective Lifetime

The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.

References (2)

https://github.com/ni/grpc-device/security/advisories/GHSA-j4qc-5v3f-rf87

Source: security@ni.com

Vendor Advisory

https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/2026/multiple-vulnerabilities-in-ni-grpc-device-server.html

Source: security@ni.com

Vendor Advisory

Timeline

No history available yet.