CVE-2026-116488 in mcuxsdk-middleware-usb
Summary
by MITRE • 10/26/2026
NXP MCUXpresso SDK USB middleware (mcuxsdk-middleware-usb) before 2.13.0 contains a heap buffer overflow in host audio, video and CDC class drivers that trust device-supplied bNumEndpoints and bLength values. A malicious USB device can supply crafted descriptors that write endpoint entries past the fixed-size epList array, corrupting heap memory for code execution or denial of service.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/26/2026
The vulnerability identified in NXP MCUXpresso SDK versions prior to 2.13.0 represents a critical security flaw within the USB middleware component, specifically affecting host-side audio, video, and Communication Device Class drivers. This issue stems from an improper validation of input data received directly from connected peripheral devices. In standard USB communication protocols, device descriptors contain metadata that defines how the host should interact with the device, including details about endpoints which serve as logical channels for data transfer. The middleware in question fails to adequately verify these descriptor fields before utilizing them to allocate memory or populate internal data structures, creating a significant attack surface for malicious actors who can manipulate USB devices at the hardware level.
At the technical core of this vulnerability is a heap buffer overflow condition triggered by crafted bNumEndpoints and bLength values within USB device descriptors. When the host controller processes these descriptors, it relies on the reported number of endpoints to determine how many entries to write into a fixed-size endpoint list array located in the heap memory space. Because the middleware trusts the device-supplied count without performing strict bounds checking against the actual capacity of the epList array, a malicious USB device can supply an abnormally high value for bNumEndpoints or manipulate length fields to force writes beyond the allocated buffer boundaries. This out-of-bounds write operation corrupts adjacent heap memory structures, potentially overwriting critical metadata such as allocation headers or function pointers stored in nearby objects.
The operational impact of this vulnerability is severe, allowing a remote attacker with physical access to a USB port to achieve arbitrary code execution or cause a denial of service on the affected embedded system. By carefully crafting the malicious descriptors and exploiting the heap corruption, an attacker can overwrite control flow data within the application running on the microcontroller unit. This capability enables the injection and execution of custom firmware payloads, effectively compromising the integrity and confidentiality of the device. Alternatively, if the memory corruption leads to a crash in critical system processes or triggers a watchdog reset due to invalid state transitions, it results in a denial of service that disrupts normal operations without necessarily granting full control over the system.
This flaw aligns with Common Weakness Enumeration CWE-120, which classifies buffer copy without checking size limits as a fundamental memory safety error. Furthermore, from an offensive security perspective, this vulnerability facilitates techniques described in MITRE ATT&CK for embedded systems, particularly those involving peripheral device manipulation and local privilege escalation through hardware interfaces. The attack vector is classified under physical access requirements, meaning the threat model assumes that adversaries have direct interaction capabilities with the USB ports of the target device. This highlights the inherent risk of trusting unverified inputs from external peripherals in IoT and industrial control environments where security boundaries are often less rigid than in traditional IT infrastructure.
To mitigate this vulnerability, organizations must immediately update the NXP MCUXpresso SDK to version 2.13.0 or later, which includes patches that enforce strict validation of USB descriptor fields before processing them into internal data structures. Developers should implement rigorous bounds checking for all values derived from external device descriptors, ensuring that bNumEndpoints and related length parameters do not exceed the predefined limits of static arrays like epList. Additionally, adopting defensive programming practices such as using safe string handling functions and implementing heap protection mechanisms can provide additional layers of defense against memory corruption attacks. For systems where physical access cannot be guaranteed to be secure, deploying hardware-based USB port controls or filtering devices at the network perimeter can further reduce the risk surface associated with this class of vulnerabilities.