CVE-2026-116487
MEDIUM
5,1
Source: [email protected]
Attack Vector: physical
Attack Complexity: low
Privileges Required: none
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A
MEDIUM
4,6
Source: [email protected]
Attack Vector: physical
Attack Complexity: low
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: high
Integrity: none
Availability: none
Description
NXP MCUXpresso SDK USB middleware (mcuxsdk-middleware-usb) before 2.13.0 contains an out-of-bounds read vulnerability in USB_DeviceCdcRndisSetCommand() that trusts a host-supplied informationBufferOffset. A malicious USB host can send RNDIS SET messages for OID_GEN_CURRENT_PACKET_FILTER or OID_802_3_MULTICAST_LIST with an out-of-range offset to read and disclose device memory.
125
Out-of-bounds Read
DraftCommon Consequences
Security Scopes Affected:
Confidentiality
Availability
Other
Potential Impacts:
Read Memory
Bypass Protection Mechanism
Dos: Crash, Exit, Or Restart
Varies By Context
Applicable Platforms
Languages:
Memory-Unsafe, C, C++
Technologies:
ICS/OT
https://github.com/nxp-mcuxpresso/mcuxsdk-middleware-usb
https://github.com/nxp-mcuxpresso/mcuxsdk-middleware-usb/blob/release/26.06.00/…
https://github.com/nxp-mcuxpresso/mcuxsdk-middleware-usb/commit/209dd79f22755de…
https://mcuxpresso.nxp.com/mcuxsdk/latest/release/index.html#release-highlights
https://www.vulncheck.com/advisories/nxp-mcuxpresso-sdk-usb-middleware-before-2…