CVE-2026-48137

Katalog CVE

CVSS 9.8 · Critical EPSS 0,80%

Kerentanan Untrusted Pointer Dereference pada ni instrumentstudio, ni grpc device server. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

There is an untrusted pointer dereference vulnerability in the NI grpc-device sideband streaming API that may allow an attacker to cause an arbitrary memory dereference, potentially resulting in remote code execution.  Successful exploitation requires an attacker  to supply a specially crafted Moniker protobuf message.  This affects NI grpc-device 2.17.0 and prior versions.

Rincian

Terbit di NVD

19 Juni 2026

Terakhir diubah

25 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-822: Untrusted Pointer Dereference

EPSS (30 hari)

0,80% peluang dieksploitasi; lebih tinggi dari 55,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/ni/grpc-device/security/advisories/GHSA-ww59-ghm9-mm63 advisory vendor
• https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/2026/multiple-v... advisory vendor