Local Privilege Escalation in NI-PAL

NI strongly recommends upgrading the affected software to mitigate these vulnerabilities.  Refer to the Affected Products section for information on upgrading these products.  

NI-PAL is a common component in many NI drivers. You only need to upgrade one NI driver that includes this component once per machine.

This vulnerability affects NI-PAL 26.3.1 and prior versions. To determine the version of NI-PAL installed, follow the instructions for your operating system.

Identify Installed NI-PAL Version

1. Navigate to %WinDir%\system32\drivers folder.
2. Find the file nipalk.sys. Right-click on the file and select Properties.  
3. In the Properties window, navigate to the Details tab. Note the version listed in the Product Version field.
4. If the NI-PAL version is 26.3.1 or prior, install the patch for Windows.

• CVE-2026-18485 – 7.8 – CVSS:3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• CVE-2026-18485 – 8.5 – CVSS:4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

NI Update Service is a Windows utility that checks for and delivers updates for NI software and drivers, including security updates. It can be used to manually check for updates, configured to periodically check and notify users, or to automatically download and install updates at a scheduled time.

Some mitigations in this advisory are delivered through NI Update Service. NI recommends upgrading to NI Update Service 2026 Q3 or later to get the latest updates. NI Update Service can be installed on its own and is backwards compatible with older NI software.

At NI, we view the security of our products as an important part of our commitment to our customers.  Go to ni.com/security to stay informed and act upon security alerts and issues.

NI would like to thank AO031 for reporting this issue and working with us on coordinated disclosure.

• CVE-2026-18485 – National Vulnerability Database
• CWE-1285 – Improper Validation of Specified Index, Position, or Offset in Input