CVE-2026-116488
Received Received - Intake

USB Heap Overflow in NXP MCUXpresso SDK USB Middleware

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: VulnCheck

Description
NXP MCUXpresso SDK USB middleware (mcuxsdk-middleware-usb) before 2.13.0 contains a heap buffer overflow in host audio, video and CDC class drivers that trust device-supplied bNumEndpoints and bLength values. A malicious USB device can supply crafted descriptors that write endpoint entries past the fixed-size epList array, corrupting heap memory for code execution or denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-26
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2026-116488
EUVD
EUVD-2026-109815

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
NXP mcuxsdk-middleware-usb 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-122 A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a heap buffer overflow in NXP MCUXpresso SDK USB middleware versions before 2.13.0. It occurs in host class drivers for audio, video, and CDC devices. The issue arises because the middleware trusts device-supplied values like bNumEndpoints and bLength in USB descriptors without proper validation. A malicious USB device can craft descriptors that cause the software to write endpoint entries beyond the fixed-size epList array, leading to heap memory corruption. This can result in code execution or denial of service attacks.

Detection Guidance

To detect this vulnerability, inspect the version of NXP MCUXpresso SDK USB middleware on your system. Check if the version is below 2.13.0. Commands may include checking installed packages or repository versions depending on your environment. Review USB device logs for malformed descriptors or unexpected behavior during device enumeration.

Impact Analysis

If you use affected versions of the NXP MCUXpresso SDK USB middleware, a malicious USB device could exploit this flaw to corrupt memory on your system. This may lead to arbitrary code execution, allowing attackers to take control of your device. Alternatively, it could cause denial of service, crashing your system or rendering it unresponsive. The impact depends on the privileges of the running software and the system configuration.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by exposing systems to unauthorized access or data breaches. If exploited, it may lead to loss of data integrity or confidentiality, violating regulatory requirements for protecting sensitive information. Organizations using affected systems must address this flaw to maintain compliance with these standards.

Mitigation Strategies

Immediately update the NXP MCUXpresso SDK USB middleware to version 2.13.0 or later. Avoid connecting untrusted USB devices to systems running vulnerable versions. Implement strict input validation for USB descriptors in custom applications. Monitor for unusual system behavior or crashes that may indicate exploitation attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116488. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart