{"id":"CVE-2026-116488","kind":"vulnerability","aliases":["CVE-2026-116488"],"related":[],"title":"NXP USB middleware: crafted USB descriptors overflow heap, enabling code execution","description":"NXP MCUXpresso SDK USB middleware (mcuxsdk-middleware-usb) before 2.13.0 contains a heap buffer overflow in host audio, video and CDC class drivers that trust device-supplied bNumEndpoints and bLength values. A malicious USB device can supply crafted descriptors that write endpoint entries past the fixed-size epList array, corrupting heap memory for code execution or denial of service.","summary":"The NXP MCUXpresso SDK USB host middleware trusts endpoint counts and lengths from a connected USB device, so a malicious device can write past a fixed heap array. An attacker with such a device can corrupt memory to crash the firmware or run code on the microcontroller.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded","mcuxpresso-sdk","nxp","package","usb-host"],"not_affected_if":["host-class-drivers-disabled","usb-device-only"],"how_to_check":"- Check the version of `mcuxsdk-middleware-usb` in your MCUXpresso SDK manifest or project; versions below `2.13.0` are affected.\n- Confirm whether your firmware enables the USB host audio, video or CDC class drivers.","fix":"- Upgrade `mcuxsdk-middleware-usb` to `2.13.0` or later and rebuild the firmware.","status":"open","published_at":"2026-10-26T14:16:37+00:00","first_seen_at":"2026-10-26T14:30:37+00:00","triaged_at":"2026-10-26T14:32:29+00:00","updated_at":"2026-10-26T14:32:29+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-26T14:32:29Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `mcuxsdk-middleware-usb` to `2.13.0` or later and rebuild the firmware.","reach":"local","title":"NXP USB middleware: crafted USB descriptors overflow heap, enabling code execution","impact":"high","summary":"The NXP MCUXpresso SDK USB host middleware trusts endpoint counts and lengths from a connected USB device, so a malicious device can write past a fixed heap array. An attacker with such a device can corrupt memory to crash the firmware or run code on the microcontroller.","category":"package","nicknames":[],"who_cares":["nxp","mcuxpresso-sdk","embedded","usb-host"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker-supplied USB device runs code on the microcontroller","analyst_note":"Check the NVD entry and NXP advisory for the exact affected class drivers and whether a physical USB connection is the only attack path.","how_to_check":"- Check the version of `mcuxsdk-middleware-usb` in your MCUXpresso SDK manifest or project; versions below `2.13.0` are affected.\n- Confirm whether your firmware enables the USB host audio, video or CDC class drivers.","needs_analyst":true,"not_affected_if":["usb-device-only","host-class-drivers-disabled"],"who_is_affected":"Teams building embedded firmware on NXP MCUXpresso SDK that acts as a USB host and enables the host audio, video or CDC class drivers. Devices that only act as USB peripherals, or that do not enable these host class drivers, are not exposed through this code path.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000636,"input_tokens":3378,"output_tokens":597,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116488':14A,17A '-2026':13A,16A '2.13.0':84C 'array':54B,125C 'attack':56B 'audio':92C 'blength':105C 'bnumendpoint':103C 'buffer':88C 'cdc':95C 'class':96C 'code':10A,70B,130C 'connect':41B 'contain':85C 'corrupt':62B,126C 'count':36B 'craft':4A,113C 'crash':65B 'cve':12A,15A 'denial':133C 'descriptor':6A,114C 'devic':43B,47B,60B,101C,110C 'device-suppli':100C 'driver':97C 'embed':18B 'enabl':9A 'endpoint':35B,117C 'entri':118C 'eplist':124C 'execut':11A,131C 'firmwar':67B 'fix':52B,122C 'fixed-s':121C 'heap':8A,53B,87C,127C 'host':26B,32B,91C 'length':38B 'malici':46B,108C 'mcuxpresso':20B,29B,75C 'mcuxpresso-sdk':19B 'mcuxsdk':80C 'mcuxsdk-middleware-usb':79C 'memori':63B,128C 'microcontrol':73B 'middlewar':3A,33B,78C,81C 'nxp':1A,22B,28B,74C 'overflow':7A,89C 'packag':23B 'past':50B,119C 'run':69B 'sdk':21B,30B,76C 'servic':135C 'size':123C 'suppli':102C,112C 'trust':34B,99C 'usb':2A,5A,25B,31B,42B,77C,82C,109C 'usb-host':24B 'valu':106C 'video':93C 'write':49B,116C","nicknames":[],"mitigations":[],"who_affected":"Teams building embedded firmware on NXP MCUXpresso SDK that acts as a USB host and enables the host audio, video or CDC class drivers. Devices that only act as USB peripherals, or that do not enable these host class drivers, are not exposed through this code path.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T14:16:37+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116488","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116488","severity":null,"published_at":"2026-10-26T14:16:37+00:00","modified_at":"2026-10-26T14:16:37+00:00","first_seen_at":"2026-10-26T14:30:37+00:00","fetched_at":"2026-10-26T14:30:37+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}