CVE-2026-18485
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
A local privilege escalation vulnerability has been discovered in the NI-PAL kernel driver. It may allow a local, authenticated user to escalate privileges and execute arbitrary code. This vulnerability affects NI-PAL 26.3.1 and prior versions running on Microsoft Windows.
Risk Assessment
The risk is that a local user with limited privileges can gain full control of the system, potentially leading to system integrity compromise, data theft, or malware installation.
Recommendation
It is recommended to upgrade the NI-PAL driver to a version newer than 26.3.1 if available. Also restrict local access to critical systems and monitor user activity.
Other vulnerabilities in NI-PAL
See all- CVE-2026-8036High
NI-PAL 26.3.0 and prior versions on Windows and Linux have an improper input validation vulnerability that may allow a local authenticated user to access arbitrary system memory, potentially leading to privilege escalation.
- CVE-2026-8035High
Improper input validation in the NI-PAL kernel driver may allow a local authenticated user to cause a denial of service by triggering a crash due to a NULL pointer dereference. This vulnerability affects NI-PAL 26.3.0 and prior versions on Windows and Linux.
Original NVD description (English source)
There is a local privilege escalation vulnerability recently discovered in the NI-PAL kernel driver. This may allow a local, authenticated user to escalate privileges and execute arbitrary code. This vulnerability affects NI-PAL 26.3.1 and prior versions running on Microsoft Windows.