This vulnerability is an out-of-bounds read caused by a missing bounds check in the NI grpc-device streaming API. If an attacker supplies a specially crafted write request, the application may read beyond the intended memory buffer, potentially leading to a denial of service. The impact is limited to application crashes or unintended termination, with no disclosed data leak or code execution.

Affected vendors include NI InstrumentStudio and NI grpc-device. The specific vulnerable product is NI grpc-device version 2.17.0 and all earlier releases. InstrumentStudio users should verify whether they are using a bundled version of grpc-device that includes the vulnerable code.

The CVSS score of 8.7 classifies the issue as high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a network‑bound request to the grpc-device streaming API, requiring the attacker to be able to send a crafted write request. Successful exploitation would result in a service crash rather than remote code execution or data theft. No public exploit has been seen so far.