CVE-2026-48137
Critical · 9.1CVSS
9.1
EPSS
0.8%
Published
Jun 19, 2026
CISA due date
—
The record
There is an untrusted pointer dereference vulnerability in the NI grpc-device sideband streaming API that may allow an attacker to cause an arbitrary memory dereference, potentially resulting in remote code execution. Successful exploitation requires an attacker to supply a specially crafted Moniker protobuf message. This affects NI grpc-device 2.17.0 and prior versions.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-83939 Untrusted pointer dereference in Windows Secure Kernel Mode allows an authorized attacker… CWE-822
- CVE-2026-83498 Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave… CWE-822
- CVE-2026-80083 Untrusted pointer dereference in Windows Hyper-V allows an authorized attacker to execute… CWE-822
- CVE-2026-78451 Untrusted pointer dereference in Microsoft Windows SCSI Class System File allows an… CWE-822
- CVE-2026-78444 Untrusted pointer dereference in Windows Failover Cluster allows an unauthorized attacker… CWE-822
- CVE-2026-72956 Untrusted pointer dereference in Microsoft Office PowerPoint allows an unauthorized… CWE-822
- CVE-2026-10420 Untrusted pointer dereference vulnerability in Samsung Open Source mTower allows Pointer… CWE-822
- CVE-2026-82927 Untrusted pointer dereference vulnerability in Samsung Open Source mTower allows Pointer… CWE-822