CVE-2026-116487

NXP MCUXpresso SDK USB Middleware before 2.13.0 RNDIS Out-of-Bounds Read

5.1 MediumPublic exploit

NXP MCUXpresso SDK USB middleware (mcuxsdk-middleware-usb) before 2.13.0 contains an out-of-bounds read vulnerability in USB_DeviceCdcRndisSetCommand() that trusts a host-supplied informationBufferOffset. A malicious USB host can send RNDIS SET messages for OID_GEN_CURRENT_PACKET_FILTER or OID_802_3_MULTICAST_LIST with an out-of-range offset to read and disclose device memory.

Attack profile

How easy it is to exploit

Attack vector: Physical
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

0.29%Unchanged since Oct 27, 2026

What each source reports

CVE List Score used 5.1

NXP MCUXpresso SDK USB Middleware before 2.13.0 RNDIS Out-of-Bounds Read

Record: CVE-2026-116487
CVSS 4.0: 5.1 MediumCVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1: 4.6 MediumCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-125
Updated: 2026-11-04

EUVDEUVD-2026-109814 5.1

Record: EUVD-2026-109814
CVSS 4.0: 5.1 MediumCVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Updated: 2026-11-04

GitHub AdvisoriesGHSA-74fm-34h8-j2pw 5.1

NXP MCUXpresso SDK USB middleware (mcuxsdk-middleware-usb) before 2.13.0 contains an out-of...

Record: GHSA-74fm-34h8-j2pw
CVSS 4.0: 5.1 MediumCVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 4.6 MediumCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-125
Updated: 2026-11-02

NVD 5.1

Record: CVE-2026-116487
CVSS 4.0: 5.1 MediumCVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 4.6 MediumCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-125
Updated: 2026-11-04

OSV 5.1

NXP MCUXpresso SDK USB Middleware before 2.13.0 RNDIS Out-of-Bounds Read

Record: CVE-2026-116487
CVSS 4.0: 5.1 MediumCVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Weakness: CWE-125
Updated: 2026-11-06

Affected products

nxp mcuxsdk-middleware-usb

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
PoC in GitHub	D7EAD/CVE-2026-116487	2026-10-26

History

History
Recorded	Changed	Sources
Nov 4, 2026	facts	CVE List, EUVD, NVD
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-116487 is a medium vulnerability (CVSS 5.1) in Nxp Mcuxsdk-middleware-usb, published October 26, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.29%, the 22nd percentile. No source names a fixed version.