CVE-2026-18485
Received Received - Intake

Local Privilege Escalation in NI-PAL Kernel Driver

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: National Instruments

Description
There is a local privilege escalation vulnerability recently discovered in the NI-PAL kernel driver.  This may allow a local, authenticated user to escalate privileges and execute arbitrary code.  This vulnerability affects NI-PAL 26.3.1 and prior versions running on Microsoft Windows.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-18485
EUVD
EUVD-2026-53579

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
ni ni-pal to 26.3.1 (exc)
ni pal to 26.3.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1285 The product receives input that is expected to specify an index, position, or offset into an indexable resource such as a buffer or file, but it does not validate or incorrectly validates that the specified index/position/offset has the required properties.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-18485 is a local privilege escalation vulnerability in the NI-PAL kernel driver. It allows a local, authenticated user to escalate privileges and execute arbitrary code on affected systems running Microsoft Windows.

Detection Guidance

To detect this vulnerability, check the installed NI-PAL version by navigating to the %WinDir%\system32\drivers folder, locating the nipalk.sys file, and reviewing its properties. If the version is 26.3.1 or earlier, the system is affected.

Impact Analysis

This vulnerability could allow an attacker with local access to gain higher privileges on your system, potentially leading to unauthorized code execution. It affects systems running NI-PAL 26.3.1 or earlier, which are commonly included in many NI drivers.

Mitigation Strategies

Upgrade to NI-PAL versions included in NI-VISA 2026 Q3 or later to mitigate the risk. NI strongly recommends applying this update as soon as possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18485. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart