CVE-2026-116488
MediumCVSS 6.8Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
NXP MCUXpresso SDK USB middleware (mcuxsdk-middleware-usb) before 2.13.0 contains a heap buffer overflow in host audio, video and CDC class drivers that trust device-supplied bNumEndpoints and bLength values. A malicious USB device can supply crafted descriptors that write endpoint entries past the fixed-size epList array, corrupting heap memory for code execution or denial of service.
Risk Assessment
This can lead to arbitrary code execution or denial of service on devices running the SDK that handle untrusted USB devices. Risk applies to embedded systems exposed to malicious USB device connections.
Recommendation
Upgrade mcuxsdk-middleware-usb to version 2.13.0 or later. Where possible, restrict connection of untrusted USB devices to systems using this SDK.
Other vulnerabilities in mcuxsdk-middleware-usb
Original NVD description (English source)
NXP MCUXpresso SDK USB middleware (mcuxsdk-middleware-usb) before 2.13.0 contains a heap buffer overflow in host audio, video and CDC class drivers that trust device-supplied bNumEndpoints and bLength values. A malicious USB device can supply crafted descriptors that write endpoint entries past the fixed-size epList array, corrupting heap memory for code execution or denial of service.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS