Vulnerability record · CVE-2026-8035 · published 2 June 2026

CVE-2026-8035: Ni-pal null pointer dereference vulnerability

NNi · Ni Pal

Improper input validation in the NI-PAL kernel driver may allow a local authenticated user to cause a denial of service by triggering a crash due to a NULL pointer dereference. This vulnerability affects NI-PAL 26.3.0 and prior versions on Windows and Linux.

6.9 CVSS 4.0 Medium EPSS 0.14% · top 97.2% CWE-476 · NULL pointer dereference

6.9CVSS 4.0 base score

0.14%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

1References

22 Jul 2026Last modified by NVD

Description

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

NNi Pal Ni

References

Link	Tags
https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/2026/invalid-input-valida	Vendor Advisory

Track CVE-2026-8035 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.4CVE-2026-8036Ni-pal vulnerabilityImproper input validation in NI-PAL may allow a local authenticated user to access arbitrary system memory, potentially leading to privilege escalati…EPSS 0.15%2 Jun 2026 7.8CVE-2021-38304Ni-pal improper input validation vulnerabilityImproper input validation in the National Instruments NI-PAL driver in versions 20.0.0 and prior may allow a privileged user to potentially enable es…EPSS 0.44%17 Sep 2021 6.2CVE-2026-21525Windows Remote Access Connection Manager null pointer dereference DoSWindows Remote Access Connection Manager contains a null pointer dereference (CWE-476) that lets an unauthorized attacker deny service locally. The f…KEVEPSS 4.8%analysed10 Feb 2026

Source: NIST National Vulnerability Database (record CVE-2026-8035), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.