CVE-2026-12052
Received Received - Intake

USB Stack Buffer Overflow in Zephyr RTOS CDC NCM Class

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: Zephyr Project

Description
The USB device-side CDC NCM class control-to-host handler usbd_cdc_ncm_cth in subsys/usb/device_next/class/usbd_cdc_ncm.c builds a fixed-size response for the GET_NTB_PARAMETERS (28-byte struct ntb_parameters) and GET_NTB_INPUT_SIZE (8-byte struct ntb_input_size) class requests and copies the whole structure into the control DATA IN buffer with net_buf_add_mem(buf, ..., sizeof(...)), ignoring the host-supplied wLength. The control DATA IN buffer is allocated by the USB stack with a capacity of exactly wLength bytes (usbd_ep_ctrl_data_in_alloc -> udc_ctrl_data_alloc -> net_buf_alloc_len(&udc_ep_pool, wLength); no round-up is applied for the IN endpoint). Because net_buf_add_mem/net_buf_simple_add only bounds the copy with an __ASSERT_NO_MSG, which is compiled out in production builds, a host that issues one of these standard CDC NCM control requests with a wLength smaller than the response structure (e.g. wLength = 1) causes the handler to memcpy up to 27 bytes past the end of the allocated pool buffer. The request fields come straight from the USB SETUP packet, so any host (or USB interposer) the Zephyr device enumerates against can trigger the overflow with no authentication once an image built with the device_next USB stack and the CDC NCM class is connected. The out-of-bounds write corrupts adjacent allocations and metadata in the shared udc_ep_pool, primarily causing memory corruption and denial of service of the USB stack; the overflow length is bounded (<= 27 bytes) and the written content is fixed device constants, and the bug reads nothing back so there is no information disclosure. The fix clamps the copy with MIN(sizeof(...), setup->wLength), matching the existing CDC ACM handler.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-11
Last Modified
2026-08-11
Generated
2026-08-11
AI Q&A
2026-08-11
EPSS Evaluated
N/A
NVD
CVE-2026-12052
EUVD
EUVD-2026-55967

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
zephyrproject zephyr From 4.0.0 (inc) to 4.4.1 (inc)
zephyrproject zephyr 4.5.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a buffer overflow vulnerability in the Zephyr RTOS USB CDC NCM class control handler. When a host sends a USB control request with a small wLength value, the handler copies a fixed-size response buffer into a smaller allocated buffer, causing an out-of-bounds write. This corrupts adjacent memory in the shared USB stack pool, leading to memory corruption and potential denial of service.

Detection Guidance

This vulnerability is specific to Zephyr RTOS USB CDC NCM class implementations and requires direct USB device interaction. Detection involves checking Zephyr RTOS versions between 4.0.0 and 4.4.1 and inspecting USB device logs for malformed control requests. No standard network commands apply. Review USB device stack source code for the affected files and functions mentioned in the CVE description.

Impact Analysis

An attacker can exploit this by connecting a malicious USB device or interposer to trigger the overflow. This causes memory corruption in the USB stack, potentially crashing the device or disrupting USB functionality. The impact is limited to denial of service and integrity issues, with no information disclosure.

Compliance Impact

This vulnerability primarily impacts system availability and integrity due to memory corruption and potential denial of service in the USB stack. It does not directly cause data disclosure, which is a key concern for GDPR and HIPAA. However, if exploited, it could lead to system instability, indirectly affecting compliance by disrupting data processing or device functionality.

Mitigation Strategies
  • Upgrade Zephyr RTOS to version 4.5.0 or later where the fix is included.
  • Apply the patch from Resource 1 to clamp copy sizes in GET_NTB_PARAMETERS and GET_NTB_INPUT_SIZE handlers.
  • Disable USB CDC NCM functionality if not required, reducing attack surface.
  • Monitor USB device logs for unusual control requests with small wLength values.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-12052. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart