CVE-2026-48140
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
There is an unchecked enum cast vulnerability in NI grpc-device version 2.17.0 and prior in the BeginSidebandStream function. This may allow an attacker to trigger invalid enum states and undefined behavior, potentially resulting in a denial of service.
Risk Assessment
Exploitation of this vulnerability could lead to denial of service, affecting system availability. An attacker needs to supply a specially crafted message containing an out-of-range value.
Recommendation
It is recommended to update NI grpc-device to the latest version to mitigate this vulnerability. Additionally, monitoring and filtering incoming messages should be implemented to prevent malicious data from being delivered.
Other vulnerabilities in NI grpc-device
See all- CVE-2026-48137Critical
There is an untrusted pointer dereference vulnerability in the NI grpc-device sideband streaming API that may allow an attacker to cause an arbitrary memory dereference, potentially resulting in remote code execution. Successful exploitation requires an attacker to supply a specially crafted Moniker protobuf message.
- CVE-2026-48141Medium
There is a memory leak in NI grpc-device version 2.17.0 and prior in the BeginSidebandStream function, which may lead to denial of service due to memory exhaustion.
Original NVD description (English source)
There is an unchecked enum cast vulnerability in NI grpc-device BeginSidebandStream that may allow an attacker to trigger invalid enum states and undefined behavior, potentially resulting in a denial of service. Successful exploitation requires an attacker to supply a specially crafted message containing an out-of-range value. This affects NI grpc-device 2.17.0 and prior versions.