The vulnerability CVE-2026-48138 in NI grpc-device involves an out-of-bounds read (CWE-125) due to a missing bounds check in the streaming API. An attacker can exploit this by sending a specially crafted write request, which may cause the application to crash or become unavailable, resulting in a denial of service condition. The affected versions include all releases prior to 2.17.1. There is no vendor advisory or patch currently available, and no known exploits have been reported in the wild.

Successful exploitation of this vulnerability results in a denial of service (DoS) condition by causing an out-of-bounds read in the grpc-device streaming API. There is no impact on confidentiality or integrity reported. The attack vector is network-based with no privileges or user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the grpc-device service to trusted networks and monitor for unusual activity related to write requests. No official remediation or temporary fixes have been provided by the vendor at this time.