Vulnerability · Published Oct 26, 2026 · Assigned by VulnCheck

CVE-2026-116487NXP MCUXpresso SDK USB Middleware before 2.13.0 RNDIS Out-of-Bounds Read

Medium 4.6

In plain English

A medium-severity out-of-bounds read in mcuxsdk-middleware-usb from NXP. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)4.6Medium

Exploit odds (30 days)0.3%top 77.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

NXP MCUXpresso SDK USB middleware (mcuxsdk-middleware-usb) before 2.13.0 contains an out-of-bounds read vulnerability in USB_DeviceCdcRndisSetCommand() that trusts a host-supplied informationBufferOffset. A malicious USB host can send RNDIS SET messages for OID_GEN_CURRENT_PACKET_FILTER or OID_802_3_MULTICAST_LIST with an out-of-range offset to read and disclose device memory.

Affected products (as reported)

Vendor	Product	Versions
NXP	mcuxsdk-middleware-usb	0 – before 2.13.0

Weakness: CWE-125 · Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

Patch Commit patch
https://github.com/nxp-mcuxpresso/mcuxsdk-middleware-usb/blob/release/26.06.00/device/class/usb_device_cdc_rndis.c#L956-L964 technical-description
MCUXpresso SDK Release Notes release-notes
https://github.com/nxp-mcuxpresso/mcuxsdk-middleware-usb product
VulnCheck Advisory: NXP MCUXpresso SDK USB Middleware before 2.13.0 RNDIS Out-of-Bounds Read third-party-advisory