{"id":"CVE-2026-116487","kind":"vulnerability","aliases":["CVE-2026-116487"],"related":[],"title":"NXP MCUXpresso USB middleware: malicious USB host reads device memory","description":"NXP MCUXpresso SDK USB middleware (mcuxsdk-middleware-usb) before 2.13.0 contains an out-of-bounds read vulnerability in USB_DeviceCdcRndisSetCommand() that trusts a host-supplied informationBufferOffset. A malicious USB host can send RNDIS SET messages for OID_GEN_CURRENT_PACKET_FILTER or OID_802_3_MULTICAST_LIST with an out-of-range offset to read and disclose device memory.","summary":"The NXP MCUXpresso SDK USB middleware before 2.13.0 trusts an offset supplied by the connected USB host when handling RNDIS SET messages. A malicious host can use an out-of-range offset to read and disclose memory on the device.","severity":"medium","cvss":5.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded","firmware","infrastructure","mcuxpresso","nxp","usb"],"not_affected_if":["rndis-not-enabled","trusted-host-only"],"how_to_check":"- Check the version of mcuxsdk-middleware-usb in the project manifest or SDK tree against `2.13.0`\n- Search the firmware source for `USB_DeviceCdcRndisSetCommand` to confirm the RNDIS CDC function is compiled in","fix":"- Upgrade mcuxsdk-middleware-usb to `2.13.0` or later\n- Rebuild and reflash the firmware after the upgrade","status":"open","published_at":"2026-10-26T14:16:37+00:00","first_seen_at":"2026-10-26T14:30:37+00:00","triaged_at":"2026-10-26T14:32:48+00:00","updated_at":"2026-10-26T14:32:48+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-26T14:32:48Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade mcuxsdk-middleware-usb to `2.13.0` or later\n- Rebuild and reflash the firmware after the upgrade","reach":"local","title":"NXP MCUXpresso USB middleware: malicious USB host reads device memory","impact":"low","summary":"The NXP MCUXpresso SDK USB middleware before 2.13.0 trusts an offset supplied by the connected USB host when handling RNDIS SET messages. A malicious host can use an out-of-range offset to read and disclose memory on the device.","category":"infrastructure","nicknames":[],"who_cares":["embedded","nxp","mcuxpresso","usb","firmware"],"confidence":0.6,"needs_auth":"no","worst_case":"A connected USB host reads device memory contents","analyst_note":"","how_to_check":"- Check the version of mcuxsdk-middleware-usb in the project manifest or SDK tree against `2.13.0`\n- Search the firmware source for `USB_DeviceCdcRndisSetCommand` to confirm the RNDIS CDC function is compiled in","needs_analyst":false,"not_affected_if":["rndis-not-enabled","trusted-host-only"],"who_is_affected":"Embedded firmware built on the NXP MCUXpresso SDK USB middleware that enables the CDC RNDIS class and accepts connections from untrusted USB hosts. Devices that only expose other USB classes or that run a different USB stack are not affected by this function. Deployments where the device is only connected to trusted hosts carry less risk.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000629,"input_tokens":3409,"output_tokens":576,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116487':13A,16A '-2026':12A,15A '2.13.0':30B,74C '3':111C '802':110C 'bound':80C 'connect':37B 'contain':75C 'current':105C 'cve':11A,14A 'devic':9A,63B,125C 'devicecdcrndissetcommand':85C 'disclos':59B,124C 'embed':17B 'filter':107C 'firmwar':18B 'gen':104C 'handl':41B 'host':7A,39B,47B,90C,96C 'host-suppli':89C 'informationbufferoffset':92C 'infrastructur':19B 'list':113C 'malici':5A,46B,94C 'mcuxpresso':2A,20B,25B,65C 'mcuxsdk':70C 'mcuxsdk-middleware-usb':69C 'memori':10A,60B,126C 'messag':44B,101C 'middlewar':4A,28B,68C,71C 'multicast':112C 'nxp':1A,21B,24B,64C 'offset':33B,55B,120C 'oid':103C,109C 'out-of-bound':77C 'out-of-rang':51B,116C 'packet':106C 'rang':54B,119C 'read':8A,57B,81C,122C 'rndis':42B,99C 'sdk':26B,66C 'send':98C 'set':43B,100C 'suppli':34B,91C 'trust':31B,87C 'usb':3A,6A,22B,27B,38B,67C,72C,84C,95C 'use':49B 'vulner':82C","nicknames":[],"mitigations":[],"who_affected":"Embedded firmware built on the NXP MCUXpresso SDK USB middleware that enables the CDC RNDIS class and accepts connections from untrusted USB hosts. Devices that only expose other USB classes or that run a different USB stack are not affected by this function. Deployments where the device is only connected to trusted hosts carry less risk.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T14:16:37+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116487","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116487","severity":null,"published_at":"2026-10-26T14:16:37+00:00","modified_at":"2026-10-26T14:16:37+00:00","first_seen_at":"2026-10-26T14:30:37+00:00","fetched_at":"2026-10-26T14:30:37+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}