CVE-2026-48140 Details
Description
There is an unchecked enum cast vulnerability in NI grpc-device BeginSidebandStream that may allow an attacker to trigger invalid enum states and undefined behavior, potentially resulting in a denial of service. Successful exploitation requires an attacker to supply a specially crafted message containing an out-of-range value. This affects NI grpc-device 2.17.0 and prior versions.
A vulnerability allowing unchecked enum casts has been identified in the NI gRPC Device Server, specifically in the BeginSidebandStream function. This vulnerability may enable an attacker to send a specially crafted message with an out-of-range value, triggering invalid enum states and undefined behavior. Such exploitation could lead to a denial-of-service condition. The issue affects NI gRPC Device Server versions through 2.17.0.
Users are advised to upgrade to NI gRPC Device Server version 2.18.0 or later. For those using the NI Update Service, this update can be obtained through the service.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-704 | Incorrect Type Conversion or Cast | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ni instrumentstudio | <= 2025 2026 q1 2026 q2 |
CPE
Remediation
| |
| ni ni grpc device server | < 2.18.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 25, 2026 | Initial Analysis | [email protected] |
| Jun 22, 2026 | CVE Modified | CISA-ADP |
| Jun 19, 2026 | New CVE Received | [email protected] |