The vulnerability is an untrusted pointer dereference in the NI grpc-device sideband streaming API. An attacker can supply a specially crafted Moniker protobuf message that leads to an arbitrary memory dereference, potentially allowing the attacker to execute arbitrary code on the affected system. The weakness is categorized as CWE-822.

The issue affects NI grpc-device version 2.17.0 and earlier. It also impacts NI InstrumentStudio, though specific version information is not detailed. The vulnerability is present in the sideband streaming API used by both products.

The CVSS base score of 9.3 indicates critical severity, and the vulnerability is not listed in CISA’s KEV catalog. EPSS data is unavailable, so the likelihood assessment is uncertain. Based on the description, the attacker must remotely send a crafted Moniker protobuf over the grpc-device sideband streaming channel; thus the likely attack path is a remote exploitation from within the network or across the internet if the service is exposed. Successful exploitation could lead to remote code execution on the host running grpc-device.