{"schema":"threatline.record/2","record":{"id":"CVE-2026-116487","aliases":[],"summary":"NXP MCUXpresso SDK USB Middleware before 2.13.0 RNDIS Out-of-Bounds Read","details":"NXP MCUXpresso SDK USB middleware (mcuxsdk-middleware-usb) before 2.13.0 contains an out-of-bounds read vulnerability in USB_DeviceCdcRndisSetCommand() that trusts a host-supplied informationBufferOffset. A malicious USB host can send RNDIS SET messages for OID_GEN_CURRENT_PACKET_FILTER or OID_802_3_MULTICAST_LIST with an out-of-range offset to read and disclose device memory.","categories":["Unclassified"],"product":"mcuxsdk-middleware-usb","vendor":"NXP","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-116487","source_modified_at":"2026-10-26T13:08:52.737Z","fetched_at":"2026-10-26T19:10:57.178988Z","product":"mcuxsdk-middleware-usb","vendor":"NXP","versions":[{"version":"0","status":"affected","lessThan":"2.13.0","versionType":"custom"},{"version":"2.13.0","status":"unaffected","versionType":"custom"}],"defaultStatus":"unaffected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-116487","source_modified_at":"2026-10-26T13:08:52.737Z","fetched_at":"2026-10-26T19:10:57.178988Z","package":{"name":"mcuxsdk-middleware-usb","ecosystem":null},"version":"2.13.0","basis":"first unaffected version stated in the CVE record"}],"cvss":5.1,"severity":"Medium","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-26T13:08:52.737Z","modified_at":"2026-10-26T13:08:52.737Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-116487","fetched_at":"2026-10-26T19:10:57.178988Z","source_modified_at":"2026-10-26T13:08:52.737Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://github.com/nxp-mcuxpresso/mcuxsdk-middleware-usb/commit/209dd79f22755de93751d6f237d3bae5511046cf","tags":["patch"]},{"source":"CVE List","url":"https://github.com/nxp-mcuxpresso/mcuxsdk-middleware-usb/blob/release/26.06.00/device/class/usb_device_cdc_rndis.c#L956-L964","tags":["technical-description"]},{"source":"CVE List","url":"https://mcuxpresso.nxp.com/mcuxsdk/latest/release/index.html#release-highlights","tags":["release-notes"]},{"source":"CVE List","url":"https://github.com/nxp-mcuxpresso/mcuxsdk-middleware-usb","tags":["product"]},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/nxp-mcuxpresso-sdk-usb-middleware-before-2.13.0-rndis-out-of-bounds-read","tags":["third-party-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-26T13:08:52.737Z","content_hash":"2b7c63506ec60028ae9dc051d8de0ce5ffff0f5ef0c52ba570bc66cb7bfa4db2"}}