Live › vulnerability › CVE-2026-116487
Go to dashboardThe NXP MCUXpresso SDK USB middleware before 2.13.0 trusts an offset supplied by the connected USB host when handling RNDIS SET messages. A malicious host can use an out-of-range offset to read and disclose memory on the device.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 14:30 UTC. All times on this page are UTC.
Embedded firmware built on the NXP MCUXpresso SDK USB middleware that enables the CDC RNDIS class and accepts connections from untrusted USB hosts. Devices that only expose other USB classes or that run a different USB stack are not affected by this function. Deployments where the device is only connected to trusted hosts carry less risk.
No product ranges from the sources yet.
2.13.0USB_DeviceCdcRndisSetCommand to confirm the RNDIS CDC function is compiled in2.13.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
NXP MCUXpresso SDK USB middleware (mcuxsdk-middleware-usb) before 2.13.0 contains an out-of-bounds read vulnerability in USB_DeviceCdcRndisSetCommand() that trusts a host-supplied informationBufferOffset. A malicious USB host can send RNDIS SET messages for OID_GEN_CURRENT_PACKET_FILTER or OID_802_3_MULTICAST_LIST with an out-of-range offset to read and disclose device memory.
This page as .md · .json · in your agent: get_signal("CVE-2026-116487")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.