MCUXpresso USB Middleware CVE-2026-116487

Requires the target to be an NXP MCU-based device running the mcuxsdk-middleware-usb RNDIS CDC device class (USB_DeviceCdcRndisSetCommand path) at a version before 2.13.0, and the attacker must have physical USB connectivity acting as a malicious USB host. The concrete trigger, per the source diff, is an RNDIS SET message for OID_GEN_CURRENT_PACKET_FILTER or OID_802_3_MULTICAST_LIST whose host-supplied informationBufferOffset exceeds (RNDIS_MAX_EXPECTED_COMMAND_SIZE - RNDIS_SET_MSG_DATA_OFFSET - field size); the unpatched code validated only informationBufferLength and not the offset. Limiting factors: physical USB access is mandatory (no network/remote path), the device must expose the RNDIS function to an untrusted host, and impact is limited to reading/disclosing device memory with no write or code-execution capability.

This is a medium-severity, physically-gated information-disclosure flaw, and the signals are consistent rather than conflicting. The vendor CVSS 4.0 vector (AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N, 5.1) shows the dominant limiting factor clearly: AV:P means an attacker must have physical USB connectivity to the target as a malicious host, which sharply constrains real-world exploitability despite requiring no privileges (PR:N) or user interaction (UI:N). Impact is confined to confidentiality (VC:H; VI:N/VA:N) - out-of-bounds reads that leak device memory, with no code execution or integrity/availability effect. No CISA KEV entry is present in the input, so there is no public exploit identified at time of analysis, and no EPSS score was supplied, so statistical exploitation probability cannot be weighed here. vuln.today assigns a 'this_month' priority (not act_now/emergency), which aligns with the picture: a patch exists, impact is read-only, and the physical attack vector makes mass or remote exploitation impractical. Net: a legitimate issue to schedule and patch, not a high-CVSS-but-overstated emergency - exposure is realistic mainly for devices an attacker can physically reach or that expose USB to untrusted hosts. EPSS data is missing and should be checked if available.

An attacker with physical access connects a malicious USB host (or a host they control) to an embedded device running the vulnerable NXP RNDIS device class, then sends an RNDIS SET message for OID_GEN_CURRENT_PACKET_FILTER or OID_802_3_MULTICAST_LIST carrying an informationBufferOffset that points outside the command buffer. The firmware trusts the offset and reads out-of-bounds memory, returning adjacent device memory contents to the attacker's host. Given AV:P/AC:L, the attack is low-complexity once physical USB access is achieved; no public exploit is identified at time of analysis.