Keil MDK-Middleware CVE-2026-115678

Exploitation requires that the device firmware be built on Arm Keil MDK-Middleware 8.0.0-8.3.0 with the SNMP component compiled in, enabled, and reachable by the attacker over the network (typically SNMP on UDP 161). The flaw is reached during SNMP processing prior to authentication (PR:N), so no credentials or user interaction are needed once the service is exposed. Limiting factors: only devices that actually deploy and expose this SNMP stack are affected, so devices without SNMP enabled or segmented off untrusted networks are not exploitable; the realistic consequence is availability degradation (A:L), not confidentiality or integrity loss. The specific trigger mechanism beyond 'out-of-bounds read in SNMP processing' is not described in the available sources.

This is a medium-severity (CVSS 5.3) issue whose signals are internally consistent but point to a limited, denial-of-service-class impact rather than a top-tier emergency. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U) indicates a network-reachable, low-complexity, unauthenticated trigger, which is why the pre-authentication framing in the description matches PR:N. However, the impact metrics are C:N/I:N/A:L - only a low availability impact, with no confidentiality or integrity effect. This is notable because an 'out-of-bounds read' often implies potential memory disclosure (a confidentiality concern), yet the scored vector claims no confidentiality impact; this apparent tension between the 'OOB read' description and C:N should be verified with Arm, as it affects whether the real risk is a crash/DoS or also information leakage. SSVC reinforces a measured posture: Exploitation=none (no observed exploitation), Automatable=yes (SNMP is scriptable and network-facing), Technical Impact=partial. There is no CISA KEV listing and no public exploit identified, and no EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified here. Consistent with the vuln.today Decision label of 'this_month' (not act_now/emergency), this is a real but non-urgent priority: schedule remediation within the normal monthly cycle, prioritizing internet- or untrusted-network-facing embedded devices that expose the MDK-Middleware SNMP service.

An attacker who can reach the SNMP service of an embedded device built on Arm Keil MDK-Middleware (8.0.0-8.3.0) sends a crafted SNMP message to UDP 161 that is parsed before any authentication, triggering an out-of-bounds read. Because the CVSS impact is availability-only (A:L), the realistic outcome is a crash or disruption of the SNMP/network stack on the device rather than code execution or data theft. No public exploit code or PoC is identified in the available sources; exploitation is low-complexity and automatable given network reach to the SNMP endpoint.