---
id: CVE-2026-116488
title: >-
  NXP MCUXpresso SDK USB Middleware before 2.13.0 Heap Overflow via Host Class
  Drivers
summary: >-
  NXP MCUXpresso SDK USB middleware (mcuxsdk-middleware-usb) before 2.13.0
  contains a heap buffer overflow in host audio, video and CDC class drivers
  that trust device-supplied bNumEndpoints and bLength values. A malicious USB
  device can s…
severity: medium
cvss: 6.8
cvssVector: 'CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-122
vendor: NXP
product: mcuxsdk-middleware-usb
affected:
  - mcuxsdk-middleware-usb < 2.13.0
published: '2026-10-26'
updated: '2026-10-26'
sourceUpdated: '2026-10-26T13:08:53.415Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-116488'
references:
  - url: >-
      https://github.com/nxp-mcuxpresso/mcuxsdk-middleware-usb/commit/264b8e6849e609abd8e2b045bc7786818b0d2bbc
    label: Patch Commit
  - url: >-
      https://github.com/nxp-mcuxpresso/mcuxsdk-middleware-usb/commit/6a1d1a7c32026e6d83504415931c4ae97ef7b7a1
    label: Fix Commit (video)
  - url: >-
      https://github.com/nxp-mcuxpresso/mcuxsdk-middleware-usb/commit/f615b03e302f0c58de5bf1cfeb31dfb85a2e514a
    label: Fix Commit (audio)
  - url: >-
      https://github.com/nxp-mcuxpresso/mcuxsdk-middleware-usb/blob/release/26.06.00/host/class/usb_host_audio.c#L517
  - url: >-
      https://mcuxpresso.nxp.com/mcuxsdk/latest/release/index.html#release-highlights
    label: MCUXpresso SDK Release Notes
  - url: 'https://github.com/nxp-mcuxpresso/mcuxsdk-middleware-usb'
  - url: >-
      https://www.vulncheck.com/advisories/nxp-mcuxpresso-sdk-usb-middleware-before-2.13.0-heap-overflow-via-host-class-drivers
    label: >-
      VulnCheck Advisory: NXP MCUXpresso SDK USB Middleware before 2.13.0 Heap
      Overflow via Host Class Drivers
tags:
  - cve.org
ingestedAt: '2026-10-26T14:27:31.828Z'
---

## Overview

NXP MCUXpresso SDK USB middleware (mcuxsdk-middleware-usb) before 2.13.0 contains a heap buffer overflow in host audio, video and CDC class drivers that trust device-supplied bNumEndpoints and bLength values. A malicious USB device can supply crafted descriptors that write endpoint entries past the fixed-size epList array, corrupting heap memory for code execution or denial of service.

## Affected

- `mcuxsdk-middleware-usb < 2.13.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.