CVE-2026-48137: Untrusted pointer dereference in NI grpc-device sideband streaming API

Synopsis

An untrusted pointer dereference vulnerability exists in the NI grpc-device sideband streaming API, affecting grpc-device 2.17.0 and earlier and NI InstrumentStudio 26.3.0 and earlier. The flaw is reachable over the network with no authentication required; an attacker sends a specially crafted Moniker protobuf message to trigger an arbitrary memory dereference. Successful exploitation results in remote code execution on the host running the affected service. No upstream fix version has been published yet; HarborGuard tracks this advisory for patch availability and will make a patched rebuild available as soon as one is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable sideband streaming API is exposed over the network, so an attacker must be able to reach the service's listening port from a remote host.

• AuthenticationNot required

  The CVSS vector specifies PR:N, meaning no account or credential of any privilege level is needed before sending the malicious protobuf message.

• Victim interactionNot required

  The CVSS vector specifies UI:N, meaning exploitation is fully server-side and no user action such as clicking a link or opening a file is required.

• Attack complexityDetail

  The CVSS vector specifies AC:L with AT:N, meaning the exploit is reliable and condition-free with no race conditions or special environmental state required.

Blast Radius

• An attacker achieves remote code execution on the host running the affected grpc-device or InstrumentStudio service.
• The process's full memory contents are readable, exposing any secrets, keys, or data held in the service's address space at the time of exploitation.
• Persistent data accessible to the compromised process, such as configuration files, measurement records, or credentials on disk, can be read or overwritten.
• The attacker gains an execution foothold that can be used to pivot to other services or hosts on the same internal network.