A memory leak occurs in the NI grpc-device BeginSidebandStream routine, with the potential to consume system memory until exhaustion and disrupt service availability. The vulnerability is categorized as CWE-401 and carries a CVSS score of 6, indicating moderate severity. An attacker exploiting this flaw would likely cause a denial of service by repeatedly initiating sideband streams to trigger the leak.

NI’s InstrumentStudio and grpc-device products are affected, specifically the grpc-device versions 2.17.0 and all earlier releases. The vulnerability is tied to the grpc-device component within InstrumentStudio installations.

The exploitation of this memory leak can be achieved via remote gRPC calls that invoke BeginSidebandStream; no further privileged access is required. Although no EPSS score is published and the vulnerability is not listed in CISA’s KEV catalog, the moderate CVSS rating and the possibility of memory exhaustion make it a noteworthy threat. Organizations running the affected software should treat this as a high‑priority risk until a patch is applied.