TI-2017-14764 Aliases CVE-2017-20283 GHSA-vq76-7hqc-pgvj

Out-of-bounds write in NXP MQX Classic RTCS UDP recvfrom()

LOW 37CWE-787Published 2026-10-08 · Updated 2026-10-15

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · Low · Low
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

NXP MQX Classic before 5.0 contains an out-of-bounds write in the RTCS UDP recvfrom() implementation. The code does not properly enforce the receive buffer length supplied by the application, so a crafted UDP packet can overflow the destination buffer (CWE-787). An unauthenticated remote attacker can corrupt memory or cause a denial of service.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

NXP MQX Classic before 5.0 contains an out-of-bounds write vulnerability in the RTCS UDP recvfrom() implementation. Improper enforcement of the application-supplied receive buffer length may allow a crafted UDP packet to overflow the destination buffer, resulting in memory corruption, or denial of service.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.01188 68th percentileScored 2026-11-07

Fix Fixed MQX (NXP): 5.0 Classic

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
NXP	MQX	before 5.0 Classic	5.0 Classic	Patch available	CNA

MQX VendorNXP Affected before 5.0 Classic Fixed in 5.0 Classic Patch available CNA

Remediation

Update NXP MQX Classic to version 5.0 or later, which fixes this flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Fix · CNA MQX (NXP) Fixed in 5.0 Classic

Timeline

2026-10-08 Threatist record created from CVE-2017-20283
2026-10-08 Alias added: GHSA-vq76-7hqc-pgvj
2026-10-09 Priority changed: MEDIUM → LOW
2026-10-16 CISA SSVC decision points changed

References

Other 1

https://community.nxp.com/t5/MQX-Software-Solutions/Horrible-memory-leak-in-recvfrom-that-has-gone-completely/m-p/705993

TI-2021-05573 NXP MQX Integer Overflow or Wraparound CVSS 3.1CRITICAL 9.8
TI-2021-08911 NXP MCUXpresso SDK Integer Overflow or Wraparound CVSS 3.1CRITICAL 9.8
TI-2019-10598 On NXP Kinetis KV1x, Kinetis KV3x, and Kinetis K8x devices, Flash Access Controls (FAC)… CVSS 3.1CRITICAL 9.8
TI-2019-13063 The Bluetooth Low Energy implementation on NXP SDK through 2.2.1 for KW41Z devices does… CVSS 3.1HIGH 8.8
TI-2022-07063 NXP LPC55S66JBD64, LPC55S66JBD100, LPC55S66JEV98, LPC55S69JBD64, LPC55S69JBD100, and… CVSS 3.1HIGH 7.8
TI-2023-20806 A software vulnerability has been identified in the U-Boot Secondary Program Loader (SPL)… CVSS 3.1HIGH 7.8

See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences