NI-PAL Local Privilege Escalation Vulnerability CVE-2026-18485 Bulletin

Vulnerability Overview Vulnerability Name: Local Privilege Escalation in NI-PAL CVE ID: CVE-2026-18485 Discovery Date: August 5, 2026 Description: A local privilege escalation vulnerability was identified in the NI-PAL kernel driver. This vulnerability allows authenticated local users to escalate privileges and execute arbitrary code. Affected Scope Affected Products: NI-PAL version 26.3.1 and earlier, NI software running on Microsoft Windows. Affected Components: Many NI drivers include NI-PAL and are therefore affected by this vulnerability. Remediation Recommended Action: It is strongly recommended to upgrade the affected software to mitigate these vulnerabilities. Specific Steps: - For Windows Systems: 1. Navigate to the folder. 2. Locate the file , right-click, and select "Properties." 3. In the "Properties" window, go to the "Details" tab and note the version listed in the "Product Version" field. 4. If the NI-PAL version is 26.3.1 or earlier, install the Windows patch. - NI Update Service: - Install NI-VISA 2026 Q3 or later via NI Package Manager, software download, or NI Update Service to apply the patch. Additional Information CVSS Scores: - CVE-2026-18485 – 7.8 – CVSS:3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVE-2026-18485 – 8.5 – CVSS:4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Further Information: - Visit ni.com/security for the latest security alerts and issue details. Acknowledgments: - Thanks to AO031 for reporting this issue and cooperating with NI for coordinated disclosure. Additional Resources: - CVE-2026-18485 – National Vulnerability Database - CVE-1285 – Improper Verification of Index, Location, or Offset Specified in Input Code Blocks No POC code or exploit code is included on the page.

Goal Reached Thanks to every supporter — we hit 100%!

NI-PAL Local Privilege Escalation Vulnerability CVE-2026-18485 Bulletin