Zephyr Project up to 4.4.1 CDC NCM Class usbd_cdc_ncm.c usbd_cdc_ncm_cth wLength out-of-bounds write

Summaryinfo

A vulnerability, which was classified as problematic, has been found in Zephyr Project Zephyr up to 4.4.1. Impacted is the function usbd_cdc_ncm_cth of the file subsys/usb/device_next/class/usbd_cdc_ncm.c of the component CDC NCM Class Handler. This manipulation of the argument wLength causes out-of-bounds write. This vulnerability is tracked as CVE-2026-12052. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability was found in Zephyr Project Zephyr up to 4.4.1. It has been declared as problematic. Affected by this vulnerability is the function usbd_cdc_ncm_cth of the file subsys/usb/device_next/class/usbd_cdc_ncm.c of the component CDC NCM Class Handler. The manipulation of the argument wLength with an unknown input leads to a out-of-bounds write vulnerability. The CWE definition for the vulnerability is CWE-787. The product writes data past the end, or before the beginning, of the intended buffer. As an impact it is known to affect integrity, and availability. The summary by CVE is:

The USB device-side CDC NCM class control-to-host handler usbd_cdc_ncm_cth in subsys/usb/device_next/class/usbd_cdc_ncm.c builds a fixed-size response for the GET_NTB_PARAMETERS (28-byte struct ntb_parameters) and GET_NTB_INPUT_SIZE (8-byte struct ntb_input_size) class requests and copies the whole structure into the control DATA IN buffer with net_buf_add_mem(buf, ..., sizeof(...)), ignoring the host-supplied wLength. The control DATA IN buffer is allocated by the USB stack with a capacity of exactly wLength bytes (usbd_ep_ctrl_data_in_alloc -> udc_ctrl_data_alloc -> net_buf_alloc_len(&udc_ep_pool, wLength); no round-up is applied for the IN endpoint). Because net_buf_add_mem/net_buf_simple_add only bounds the copy with an __ASSERT_NO_MSG, which is compiled out in production builds, a host that issues one of these standard CDC NCM control requests with a wLength smaller than the response structure (e.g. wLength = 1) causes the handler to memcpy up to 27 bytes past the end of the allocated pool buffer. The request fields come straight from the USB SETUP packet, so any host (or USB interposer) the Zephyr device enumerates against can trigger the overflow with no authentication once an image built with the device_next USB stack and the CDC NCM class is connected. The out-of-bounds write corrupts adjacent allocations and metadata in the shared udc_ep_pool, primarily causing memory corruption and denial of service of the USB stack; the overflow length is bounded (<= 27 bytes) and the written content is fixed device constants, and the bug reads nothing back so there is no information disclosure. The fix clamps the copy with MIN(sizeof(...), setup->wLength), matching the existing CDC ACM handler.

The advisory is shared at github.com. This vulnerability is known as CVE-2026-12052 since 06/12/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available.

Upgrading to version 4.4.2 eliminates this vulnerability. Applying the patch c49b758d87914e185ff611e93473bf8ec84a378a is able to eliminate this problem.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Project Management Software

Vendor

• Zephyr Project

Name

• Zephyr

Version

• 4.4.0
• 4.4.1

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion