This vulnerability (CVE-2026-48137) involves an untrusted pointer dereference in the NI grpc-device sideband streaming API. The flaw allows an attacker to supply a maliciously crafted Moniker protobuf message, which may cause the application to dereference arbitrary memory. This can result in remote code execution. The vulnerability affects NI grpc-device versions up to and including 2.17.0. The CVSS 3.1 base score is 9.1, indicating critical severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. There is no vendor advisory or patch information currently available.

Successful exploitation can lead to remote code execution on affected systems running NI grpc-device 2.17.0 or earlier. The vulnerability does not require privileges or user interaction, increasing its risk. Confidentiality and integrity impacts are high, while availability impact is not indicated.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting network access to the grpc-device service and monitor for suspicious activity related to Moniker protobuf messages. Avoid exposing the vulnerable service to untrusted networks.