Read the docs
TI-2026-80403 Aliases CVE-2026-116488GHSA-6rvq-9jq9-prp3

Heap overflow in NXP MCUXpresso SDK USB host class drivers

Priority LOW 33CWE-122Published · Updated

Key facts

Attack vector
Physical
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-122 and the CVSS impact.

Summary

NXP MCUXpresso SDK USB middleware (mcuxsdk-middleware-usb) before 2.13.0 contains a heap-based buffer overflow (CWE-122) in its host audio, video and CDC class drivers. These drivers trust the bNumEndpoints and bLength values supplied by a USB device, so crafted descriptors can write endpoint entries past the fixed-size epList array. An attacker who connects a malicious USB device can corrupt heap memory, which may lead to code execution or denial of service.

Written with Claude Haiku 5.5 from the sources below · 2026-10-31

Description from the CNA

NXP MCUXpresso SDK USB middleware (mcuxsdk-middleware-usb) before 2.13.0 contains a heap buffer overflow in host audio, video and CDC class drivers that trust device-supplied bNumEndpoints and bLength values. A malicious USB device can supply crafted descriptors that write endpoint entries past the fixed-size epList array, corrupting heap memory for code execution or denial of service.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00374 31st percentileScored 2026-11-07
Fix Fixed mcuxsdk-middleware-usb (NXP): 2.13.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
NXPmcuxsdk-middleware-usbbefore 2.13.02.13.0Patch availableCNA
  • mcuxsdk-middleware-usb VendorNXP Affected before 2.13.0 Fixed in 2.13.0 Patch available CNA

Remediation

Update mcuxsdk-middleware-usb to version 2.13.0 or later. The sources list no fixed version beyond 2.13.0 and name no advisory identifier for this fix.

Written with Claude Haiku 5.5 from the sources below · 2026-10-31

  • Fix · CNA mcuxsdk-middleware-usb (NXP) Fixed in 2.13.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    NXP mcuxsdk-middleware-usb 2.13.0

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-80402 Out-of-bounds read in NXP MCUXpresso SDK USB middleware RNDISPriority LOW 23
    Show all 2 records →

Timeline

  1. 2026-10-26 Threatist record created from CVE-2026-116488
  2. 2026-10-27 Alias added: GHSA-6rvq-9jq9-prp3
  3. 2026-10-27 Priority changed: MEDIUM → LOW
  4. 2026-10-31 CISA SSVC decision points changed

References

Patch 3

Other 3

  • TI-2021-05573 NXP MQX Integer Overflow or Wraparound CVSS 3.1CRITICAL 9.8
  • TI-2021-08911 NXP MCUXpresso SDK Integer Overflow or Wraparound CVSS 3.1CRITICAL 9.8
  • TI-2019-10598 On NXP Kinetis KV1x, Kinetis KV3x, and Kinetis K8x devices, Flash Access Controls (FAC)… CVSS 3.1CRITICAL 9.8
  • TI-2019-13063 The Bluetooth Low Energy implementation on NXP SDK through 2.2.1 for KW41Z devices does… CVSS 3.1HIGH 8.8
  • TI-2022-07063 NXP LPC55S66JBD64, LPC55S66JBD100, LPC55S66JEV98, LPC55S69JBD64, LPC55S69JBD100, and… CVSS 3.1HIGH 7.8
  • TI-2017-14764 Out-of-bounds write in NXP MQX Classic RTCS UDP recvfrom() CVSS 3.1MEDIUM 6.5
See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences