NI-PAL Null Pointer Dereference and Privilege Escalation Vulnerabilities (CVE-2026-8035/36)

Vulnerability Overview Two invalid input validation vulnerabilities were discovered in NI-PAL. These vulnerabilities affect NI-PAL 26.3.0 and earlier versions on Windows, Linux, and Linux Real-Time systems. CVE-2026-8035: Allows a locally authenticated user to cause a denial of service by triggering a crash due to null pointer dereference. CVE-2026-8036: Allows a locally authenticated user to access arbitrary system memory, potentially leading to privilege escalation. Many NI drivers include NI-PAL and are affected by these vulnerabilities. Affected Versions Windows: NI-VISA 2026 Q2 Patch 1 (26.3.1) or earlier. Linux Desktop: NI Linux Device Drivers 2026 Q2 or earlier. Linux Real-Time: NI Linux RT System Image 2026 Q2 or earlier. Remediation NI strongly recommends upgrading the affected software to mitigate these vulnerabilities. Windows 1. Navigate to the folder. 2. Locate the file , right-click it, and select "Properties." 3. In the Properties window, navigate to the Details tab. Note the version listed in the Product Version field. 4. If the NI-PAL version is 26.3.0 or earlier, install the Windows patch. Linux Desktop 1. Use the distribution's package manager to check the version of the ni-pal package. 2. Alternatively, execute the following command to report the version of the loaded NI-PAL kernel module: 3. If the NI-PAL version is 26.3.0 or earlier, upgrade the NI driver version. Upgrade Linux 1. Install NI Linux Device Drivers 2026 Q2 according to standard instructions. 2. Install the latest updates from the terminal prompt. Ubuntu: Red Hat Enterprise Linux: openSUSE Leap: NI Linux Real-Time 1. Install NI Linux RT System Image 2026 Q2 on the host. 2. Apply NI Linux RT System Image 2026 Q2 to the target. 3. Install the latest updates from the host terminal prompt. 4. Enter target credentials if prompted. 5. At the ssh session prompt: CVSS Scores CVE-2026-8035: 7.1 - CVSS:3.1 /AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2026-8036: 6.9 - CVSS:4.0 /AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/SC:N/SI:N/SA:N Additional Information NI Update Service: The NI Update Service is a Windows utility used to check for and deliver updates for NI software and drivers, including security updates. It can manually check for updates, be configured to periodically check and notify the user, or automatically download and install updates. Further Information: NI considers product security a vital part of its commitment to customers. Visit ni.com/security for the latest information on security alerts and issues. Acknowledgments: NI thanks Patrick Saif (@weezerOSINT) for reporting this issue and collaborating with NI on coordinated disclosure. Additional Resources: - CVE-2026-8035 - National Vulnerability Database - CVE-476 - Null Pointer Dereference - CVE-2026-8036 - National Vulnerability Database - CWE-1289 - Invalid Validation of Specified Index, Position, or Offset in Input Affected Products Footer Information Solutions: Academia & Research, Aerospace & Defense, Electronics, Energy, Industrial Machinery, Life Sciences, Semiconductors, Transportation. Orders: NI Distributor Partners, Order Status and History, Get a Quote, Terms of Service, Order by Part Number or Request Quote. Company: NI is now part of Emerson, About, Emerson Careers, Newsroom, Supply Chain & Quality, Events. Support: Downloads, Product Documentation, Discussion Forums, Activate Products, Submit a Service Request, Site Feedback. Social Media Links Facebook X (Twitter) LinkedIn YouTube Instagram Language and Legal Information Dutch (English) Legal © 2026 National Instruments Corp. All rights reserved.

Goal Reached Thanks to every supporter — we hit 100%!

NI-PAL Null Pointer Dereference and Privilege Escalation Vulnerabilities (CVE-2026-8035/36)