CVE-2026-116487 in mcuxsdk-middleware-usb
Summary
by MITRE • 10/26/2026
NXP MCUXpresso SDK USB middleware (mcuxsdk-middleware-usb) before 2.13.0 contains an out-of-bounds read vulnerability in USB_DeviceCdcRndisSetCommand() that trusts a host-supplied informationBufferOffset. A malicious USB host can send RNDIS SET messages for OID_GEN_CURRENT_PACKET_FILTER or OID_802_3_MULTICAST_LIST with an out-of-range offset to read and disclose device memory.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/26/2026
The vulnerability identified in NXP MCUXpresso SDK versions prior to 2.13.0 represents a critical security flaw within the USB middleware component, specifically affecting the Universal Serial Bus Device Class Communication Device Class RNDIS implementation. This issue is located within the function responsible for handling CDC RNDIS set commands, where the software fails to adequately validate input parameters provided by the connected host device. The core of the problem lies in how the application processes information buffers during specific network configuration operations. When a USB host initiates communication using the Remote Network Driver Interface Specification protocol, it can request various operational states or configurations from the embedded device. In this context, the middleware accepts an offset value intended to point into a data buffer but does not perform sufficient bounds checking before utilizing that index for memory access operations.
From a technical perspective, the flaw is classified as an out-of-bounds read vulnerability. This occurs because the function USB_DeviceCdcRndisSetCommand() directly trusts the informationBufferOffset supplied by the host without verifying whether this offset falls within the valid boundaries of the allocated buffer space. By sending specially crafted RNDIS SET messages targeting specific Object Identifiers such as OID_GEN_CURRENT_PACKET_FILTER or OID_802_3_MULTICAST_LIST, an attacker can manipulate this offset to point beyond the end of the intended data structure. When the system attempts to read from these invalid memory addresses, it does not trigger a standard segmentation fault or exception that would halt execution safely. Instead, the operation proceeds and reads arbitrary bytes from adjacent memory locations on the device stack or heap.
The operational impact of this vulnerability is significant due to its potential for information disclosure. Since the malicious host can control the offset value, an attacker can systematically iterate through different offsets to read sensitive data stored in the microcontroller's memory. This could include cryptographic keys, session tokens, user credentials, or other proprietary application data that resides near the affected buffer in memory layout. The ability to leak this information compromises the confidentiality of the embedded system and any network communications it facilitates. Furthermore, depending on the specific memory layout and operating environment, such out-of-bounds reads might occasionally lead to undefined behavior or crashes if the accessed address is unmapped, potentially resulting in a denial of service condition for connected clients relying on stable RNDIS connectivity.
This vulnerability aligns with Common Weakness Enumeration identifier CWE-125, which describes an out-of-bounds read where software reads data past the end or before the beginning of the intended buffer. In terms of offensive security frameworks, this exploit scenario maps to ATT&CK technique T1074, specifically Data Staged or Local Data Stealing, as it involves extracting sensitive information from a local system through network-based interactions. The attack vector is classified under Network Access because the exploitation requires physical or logical connectivity via USB, which serves as the transport mechanism for delivering the malicious RNDIS commands to the vulnerable middleware layer.
To mitigate this risk, organizations utilizing NXP MCUXpresso SDK must upgrade the mcuxsdk-middleware-usb component to version 2.13.0 or later, where the developers have implemented proper bounds checking logic within the affected function. Until an update is applied, defensive measures should focus on network segmentation and strict access controls for USB ports connected to untrusted networks or devices. Implementing hardware-based USB port control can prevent unauthorized hosts from establishing RNDIS connections that could trigger this vulnerability. Additionally, developers integrating older SDK versions into their products should consider implementing custom validation wrappers around the CDC RNDIS set command handlers to ensure that all buffer offsets are verified against known safe limits before being passed to the underlying middleware functions. Regular security audits of embedded firmware and dependency management practices are essential to prevent similar issues in future deployments.