CVE-2026-116488

Medium

Description

NXP MCUXpresso SDK USB middleware (mcuxsdk-middleware-usb) before 2.13.0 contains a heap buffer overflow in host audio, video and CDC class drivers that trust device-supplied bNumEndpoints and bLength values. A malicious USB device can supply crafted descriptors that write endpoint entries past the fixed-size epList array, corrupting heap memory for code execution or denial of service.

SeverityMedium

CVSS6.8

Exploit probability—

ProductNxp Mcuxsdk-middleware-usb

PublishedOct 26, 2026

First seenOct 26, 2026

Weakness typeCWE-122CWE-122

How to fix

Update

NXP mcuxsdk-middleware-usb2.13.0 or later

Patches

Vendor advisories

mcuxpresso.nxp.com/mcuxsdk/latest/release/index.html#release-highlights

Affected products

Product	Affected versions	Fixed in
NXP mcuxsdk-middleware-usb	v < 2.13.0	2.13.0

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.