Description
NXP MCUXpresso SDK USB middleware (mcuxsdk-middleware-usb) before 2.13.0 contains a heap buffer overflow in host audio, video and CDC class drivers that trust device-supplied bNumEndpoints and bLength values. A malicious USB device can supply crafted descriptors that write endpoint entries past the fixed-size epList array, corrupting heap memory for code execution or denial of service.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| NXP | mcuxsdk-middleware-usb | < 2.13.0 | 2.13.0 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
D7EAD/CVE-2026-116488 ★ 1 · Oct 26, 2026
NXP Semiconductors USB middleware <2.13.0 contains a heap buffer overflow in host audio, video and CDC class drivers that trust device-supplied bNumEndpoints and bLength values.
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- Patch Commit patch
- Fix Commit (video) patch
- Fix Commit (audio) patch
- https://github.com/nxp-mcuxpresso/mcuxsdk-middleware-usb/blob/release/26.06.00/host/class/usb_host_audio.c#L517 technical-description
- MCUXpresso SDK Release Notes release-notes
- https://github.com/nxp-mcuxpresso/mcuxsdk-middleware-usb product
- VulnCheck Advisory: NXP MCUXpresso SDK USB Middleware before 2.13.0 Heap Overflow via Host Class Drivers third-party-advisory