CVE-2026-116487: NXP MCUXpresso SDK USB Middleware before 2.13.0 RNDIS Out-of-Bounds Read
NXP MCUXpresso SDK USB middleware (mcuxsdk-middleware-usb) before 2.13.0 contains an out-of-bounds read vulnerability in USBDeviceCdcRndisSetCommand() that trusts a host-supplied informationBufferOffset. A malicious USB host can send RNDIS SET messages for OIDGENCURRENTPACKETFILTER or OID8023MULTICASTLIST with an out-of-range offset to read and disclose device memory.
Affected Software
Event History
Frequently Asked Questions
Which devices are exposed to this issue?
Devices using NXP MCUXpresso SDK USB middleware versions before 2.13.0 and exposing the CDC RNDIS functionality are affected. Exploitation requires the attacker to act as a malicious USB host connected to the device.
What does an attacker need to send to exploit the flaw?
The attacker sends crafted RNDIS SET messages targeting OID_GEN_CURRENT_PACKET_FILTER or OID_802_3_MULTICAST_LIST. The messages use an out-of-range informationBufferOffset that is trusted by USB_DeviceCdcRndisSetCommand().
What is the impact of successful exploitation?
Successful exploitation can cause an out-of-bounds read and disclose memory from the affected device. The provided severity vector indicates confidentiality impact, with no indicated integrity or availability impact.
What remediation is identified?
Update the NXP MCUXpresso SDK USB middleware to version 2.13.0 or later. The referenced upstream commit is 209dd79f22755de93751d6f237d3bae5511046cf.