{"id":"CVE-2026-116488","aliases":["EUVD-2026-109815","GHSA-6rvq-9jq9-prp3"],"status":"published","title":"NXP MCUXpresso SDK USB Middleware before 2.13.0 Heap Overflow via Host Class Drivers","description":"NXP MCUXpresso SDK USB middleware (mcuxsdk-middleware-usb) before 2.13.0 contains a heap buffer overflow in host audio, video and CDC class drivers that trust device-supplied bNumEndpoints and bLength values. A malicious USB device can supply crafted descriptors that write endpoint entries past the fixed-size epList array, corrupting heap memory for code execution or denial of service.","severity":{"version":"4.0","score":7,"vector":"CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00374,"percentile":0.3185,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-122"],"published":"2026-10-26T13:08:53Z","modified":"2026-11-01T07:03:35Z","exploits":[{"source":"pocgithub","id":"D7EAD/CVE-2026-116488","title":"D7EAD/CVE-2026-116488","date":"2026-10-26","url":"https://github.com/D7EAD/CVE-2026-116488"}],"products":[{"vendor":"nxp","product":"mcuxsdk-middleware-usb"}],"references":[{"url":"https://github.com/nxp-mcuxpresso/mcuxsdk-middleware-usb/commit/264b8e6849e609abd8e2b045bc7786818b0d2bbc","tags":["patch","fix"]},{"url":"https://github.com/nxp-mcuxpresso/mcuxsdk-middleware-usb/commit/6a1d1a7c32026e6d83504415931c4ae97ef7b7a1","tags":["patch","fix"]},{"url":"https://github.com/nxp-mcuxpresso/mcuxsdk-middleware-usb/commit/f615b03e302f0c58de5bf1cfeb31dfb85a2e514a","tags":["patch","fix"]},{"url":"https://github.com/nxp-mcuxpresso/mcuxsdk-middleware-usb/blob/release/26.06.00/host/class/usb_host_audio.c#L517","tags":["technical-description","article"]},{"url":"https://mcuxpresso.nxp.com/mcuxsdk/latest/release/index.html#release-highlights","tags":["release-notes","advisory"]},{"url":"https://github.com/nxp-mcuxpresso/mcuxsdk-middleware-usb","tags":["product","package"]},{"url":"https://www.vulncheck.com/advisories/nxp-mcuxpresso-sdk-usb-middleware-before-2.13.0-heap-overflow-via-host-class-drivers","tags":["third-party-advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116488","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-6rvq-9jq9-prp3"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/116xxx/CVE-2026-116488.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-116488","title":"NXP MCUXpresso SDK USB Middleware before 2.13.0 Heap Overflow via Host Class Drivers","description":"NXP MCUXpresso SDK USB middleware (mcuxsdk-middleware-usb) before 2.13.0 contains a heap buffer overflow in host audio, video and CDC class drivers that trust device-supplied bNumEndpoints and bLength values. A malicious USB device can supply crafted descriptors that write endpoint entries past the fixed-size epList array, corrupting heap memory for code execution or denial of service.","status":"published","published":"2026-10-26T13:08:53.415Z","modified":"2026-10-31T01:22:44.936Z","cvss":[{"version":"4.0","score":7,"vector":"CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T14:20:03.827373Z"}],"euvd":[{"id":"EUVD-2026-109815","description":"NXP MCUXpresso SDK USB middleware (mcuxsdk-middleware-usb) before 2.13.0 contains a heap buffer overflow in host audio, video and CDC class drivers that trust device-supplied bNumEndpoints and bLength values. A malicious USB device can supply crafted descriptors that write endpoint entries past the fixed-size epList array, corrupting heap memory for code execution or denial of service.","status":"published","published":"2026-10-26T13:08:53Z","modified":"2026-10-31T01:22:44Z","cvss":[{"version":"4.0","score":7,"vector":"CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T16:59:01.198534Z"}],"ghsa":[{"id":"GHSA-6rvq-9jq9-prp3","title":"NXP MCUXpresso SDK USB middleware (mcuxsdk-middleware-usb) before 2.13.0 contains a heap buffer...","description":"NXP MCUXpresso SDK USB middleware (mcuxsdk-middleware-usb) before 2.13.0 contains a heap buffer overflow in host audio, video and CDC class drivers that trust device-supplied bNumEndpoints and bLength values. A malicious USB device can supply crafted descriptors that write endpoint entries past the fixed-size epList array, corrupting heap memory for code execution or denial of service.","status":"published","published":"2026-10-26T15:34:44Z","modified":"2026-10-26T15:34:52Z","cvss":[{"version":"4.0","score":7,"vector":"CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"},{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T15:14:23.996006Z"}],"nvd":[{"id":"CVE-2026-116488","description":"NXP MCUXpresso SDK USB middleware (mcuxsdk-middleware-usb) before 2.13.0 contains a heap buffer overflow in host audio, video and CDC class drivers that trust device-supplied bNumEndpoints and bLength values. A malicious USB device can supply crafted descriptors that write endpoint entries past the fixed-size epList array, corrupting heap memory for code execution or denial of service.","status":"published","published":"2026-10-26T14:16:37.52Z","modified":"2026-10-31T02:17:32.11Z","cvss":[{"version":"4.0","score":7,"vector":"CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T14:13:03.452847Z"}],"osv":[{"id":"CVE-2026-116488","title":"NXP MCUXpresso SDK USB Middleware before 2.13.0 Heap Overflow via Host Class Drivers","description":"NXP MCUXpresso SDK USB middleware (mcuxsdk-middleware-usb) before 2.13.0 contains a heap buffer overflow in host audio, video and CDC class drivers that trust device-supplied bNumEndpoints and bLength values. A malicious USB device can supply crafted descriptors that write endpoint entries past the fixed-size epList array, corrupting heap memory for code execution or denial of service.","status":"published","published":"2026-10-26T13:08:53.415Z","modified":"2026-11-01T07:03:35.154430298Z","cvss":[{"version":"4.0","score":7,"vector":"CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T15:44:56.675758Z"}]}}