CVE-2026-116487

MediumCVSS 4.6

Published: 26/10/2026(UTC)Updated: 26/10/2026(UTC)Translated: 26/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.30%

22th percentile - higher than 22% of all known CVEs

Summary

NXP MCUXpresso SDK USB middleware (mcuxsdk-middleware-usb) before 2.13.0 contains an out-of-bounds read vulnerability in USB_DeviceCdcRndisSetCommand() that trusts a host-supplied informationBufferOffset. A malicious USB host can send RNDIS SET messages for OID_GEN_CURRENT_PACKET_FILTER or OID_802_3_MULTICAST_LIST with an out-of-range offset to read and disclose device memory.

Risk Assessment

This may result in leakage of confidential data from embedded device memory. Risk applies to devices using this SDK that communicate with untrusted USB hosts.

Recommendation

Upgrade mcuxsdk-middleware-usb to version 2.13.0 or later. Restrict communication with untrusted USB hosts for devices using this SDK.

Other vulnerabilities in mcuxsdk-middleware-usb

CVE-2026-116488Medium
NXP MCUXpresso SDK USB middleware (mcuxsdk-middleware-usb) before 2.13.0 contains a heap buffer overflow in host audio, video and CDC class drivers that trust device-supplied bNumEndpoints and bLength values. A malicious USB device can supply crafted descriptors that write endpoint entries past the fixed-size epList array, corrupting heap memory for code execution or denial of service.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS