Improper input validation in the NI-PAL kernel driver can cause a NULL pointer dereference when a malicious local authenticated user supplies crafted input. Triggering the fault crashes the driver, resulting in a denial of service that can terminate affected applications or services.

NI’s NI‑PAL product is the target, with versions 26.3.0 and earlier affected on both Windows and Linux operating systems.

The CVSS score of 6.9 indicates a moderate risk level. EPSS data is not available and the vulnerability is not listed in CISA KEV, implying limited public exploitation. The attack vector is local only and requires an authenticated user with privileges that allow interacting with the NI‑PAL driver, such as a system administrator or a user with install rights. Given these constraints, the likelihood of widespread exploitation is low, but the impact for systems running vulnerable versions can be disruptive.