MCUXpresso USB Middleware CVE-2026-116488

The target device must run the NXP MCUXpresso USB middleware (mcuxsdk-middleware-usb) at a version before 2.13.0 and must act as a USB host using the audio, video, or CDC host class drivers (the specific files patched, e.g. host/class/usb_host_audio.c). The attacker must be able to physically connect a malicious or emulated USB device to the host so that enumeration parses the crafted descriptors - per the CVSS 4.0 AV:P vector, there is no remote or network path. Limiting factors: physical access to a USB port is mandatory; the vulnerable host class driver (audio/video/CDC) must be compiled in and active; products that only operate in USB device/peripheral mode, or that do not include these host class drivers, are not exposed. No user authentication is required by the stack (PR:N), and no end-user interaction beyond device attachment is needed.

The CVSS 4.0 base score is 7.0 (High), but the single most important signal is the attack vector: AV:P (Physical). Exploitation requires an attacker to physically attach a malicious USB device to the embedded host running the NXP MCUXpresso USB stack, which sharply narrows real-world risk compared to a network-exploitable flaw of the same score. The vector's VC:H/VI:H/VA:H is consistent with the described heap corruption leading to code execution or denial of service, and the vendor commit diff independently confirms the mechanism - class drivers trusted device-supplied bLength (and related bNumEndpoints/bNrInPins) values without bounds-checking before writing into fixed-size arrays. No EPSS score was provided and the CVE is not listed in CISA KEV, so there is no evidence of active or widespread exploitation; the vuln.today decision label is 'this_week' (not act_now/emergency). No public working exploit is provided - only vendor patch commits and a VulnCheck advisory. Net: a genuine, code-confirmed memory-corruption bug that is a priority to patch for affected embedded fleets, but the physical-access precondition makes it a targeted/evil-maid-class risk rather than a remotely wormable emergency. One note to verify: the input CVSS is a 4.0 vector only (no 3.1 vector supplied), so severity cross-checks rely on that single vector.

An attacker with physical access connects a malicious USB peripheral (or a device emulating one) to an embedded product running the NXP MCUXpresso USB host stack in audio, video, or CDC host mode. The rogue device returns crafted configuration descriptors with oversized or inconsistent bLength/bNumEndpoints fields, causing the host class driver to write endpoint entries past the fixed-size epList array and corrupt heap memory, resulting in code execution or a crash. No public working exploit code is available at time of analysis - only vendor patch commits and a VulnCheck advisory.