CVE-2026-48141 identifies a memory leak (CWE-401) in the NI grpc-device product affecting versions prior to 2.17.1. The issue occurs in the BeginSidebandStream function, where memory allocated is not properly released after its effective lifetime. This can cause the application to consume increasing amounts of memory, potentially resulting in denial of service conditions. The vulnerability has a CVSS 3.1 base score of 5.3, reflecting network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, but high impact on availability.

The memory leak can cause the grpc-device service to exhaust system memory over time, leading to denial of service. There is no direct impact on confidentiality or integrity. The vulnerability requires network access with low privileges and has a high attack complexity, limiting ease of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch has been published by NI at this time. Users should monitor NI advisories for updates and consider limiting exposure of the affected service until a fix is available.