Skip to content
OpenAdvisories
Medium · 4.6 Public exploit CVE-2026-116487 EUVD-2026-109814GHSA-74fm-34h8-j2pw

NXP MCUXpresso SDK USB Middleware before 2.13.0 RNDIS Out-of-Bounds Read

Published Oct 26, 2026 · Updated Nov 4, 2026 · Assigned by VulnCheck

Vendor: NXP Product: mcuxsdk-middleware-usb

Description

NXP MCUXpresso SDK USB middleware (mcuxsdk-middleware-usb) before 2.13.0 contains an out-of-bounds read vulnerability in USB_DeviceCdcRndisSetCommand() that trusts a host-supplied informationBufferOffset. A malicious USB host can send RNDIS SET messages for OID_GEN_CURRENT_PACKET_FILTER or OID_802_3_MULTICAST_LIST with an out-of-range offset to read and disclose device memory.

Affected products

VendorProductAffectedFixed
NXP mcuxsdk-middleware-usb < 2.13.0 2.13.0

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • D7EAD/CVE-2026-116487 ★ 1 · Oct 26, 2026

    NXP Semiconductors USB middleware <2.13.0 contains an out-of-bounds read vulnerability in USB_DeviceCdcRndisSetCommand() that trusts a host-supplied informationBufferOffset.

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References