CVE-2026-116487

mcuxsdk-middleware-usb: NXP MCUXpresso SDK USB Middleware before 2.13.0 RNDIS Out-of-Bounds Read

NXP mcuxsdk-middleware-usb

Open in Threatline Record JSON

CVSS

5.1Medium

ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV

Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet

Fixed in2.13.0Fixed versionCVE List

Published26 Oct 2026Updated 26 Oct 2026CVE List

What fixes it

2.13.0mcuxsdk-middleware-usbCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

26 Oct 2026, 13:08 UTCPublishedCVE List
26 Oct 2026, 13:13 UTCExploit code publicGitHub proof-of-concept repositories

Reports 1

1 outlet mention it. Reports are not confirmation; each links to its source.

D7EAD/CVE-2026-116487: NXP Semiconductors USB middleware <2.13.0 contains an out-of-bounds read vulnerability in USB_DeviceCdcRndisSetCommand() that trusts a host-supplied informationBufferOffset.GitHub proof-of-concept repositories, 26 Oct 2026Exploit code

Description

NXP MCUXpresso SDK USB middleware (mcuxsdk-middleware-usb) before 2.13.0 contains an out-of-bounds read vulnerability in USB_DeviceCdcRndisSetCommand() that trusts a host-supplied informationBufferOffset. A malicious USB host can send RNDIS SET messages for OID_GEN_CURRENT_PACKET_FILTER or OID_802_3_MULTICAST_LIST with an out-of-range offset to read and disclose device memory.

Text from CVE List

Affected versions 2

mcuxsdk-middleware-usbaffected: all versions before 2.13.0CVE List
mcuxsdk-middleware-usbunaffected: 2.13.0CVE List