What’s Vulnerable › Vulnerabilities

CVE-2026-116488: NXP MCUXpresso SDK USB Middleware before 2.13.0 Heap Overflow via Host Class Drivers

• Severity: medium (CVSS 6.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-26 · updated 2026-10-31
• Weakness: CWE-122

Description

NXP MCUXpresso SDK USB middleware (mcuxsdk-middleware-usb) before 2.13.0 contains a heap buffer overflow in host audio, video and CDC class drivers that trust device-supplied bNumEndpoints and bLength values. A malicious USB device can supply crafted descriptors that write endpoint entries past the fixed-size epList array, corrupting heap memory for code execution or denial of service.

Affected products

• NXP mcuxsdk-middleware-usb: before 2.13.0 — fixed in 2.13.0

How to fix

Upgrade to a fixed version: NXP mcuxsdk-middleware-usb 2.13.0. Check the vendor advisory for mitigations.

References

• https://github.com/nxp-mcuxpresso/mcuxsdk-middleware-usb
• https://github.com/nxp-mcuxpresso/mcuxsdk-middleware-usb/blob/release/26.06.00/host/class/usb_host_audio.c#L517
• https://github.com/nxp-mcuxpresso/mcuxsdk-middleware-usb/commit/264b8e6849e609abd8e2b045bc7786818b0d2bbc
• https://github.com/nxp-mcuxpresso/mcuxsdk-middleware-usb/commit/6a1d1a7c32026e6d83504415931c4ae97ef7b7a1
• https://github.com/nxp-mcuxpresso/mcuxsdk-middleware-usb/commit/f615b03e302f0c58de5bf1cfeb31dfb85a2e514a
• https://mcuxpresso.nxp.com/mcuxsdk/latest/release/index.html#release-highlights
• https://www.vulncheck.com/advisories/nxp-mcuxpresso-sdk-usb-middleware-before-2.13.0-heap-overflow-via-host-class-drivers

Get alerted when CVE-2026-116488 or the next vulnerability affects your stack