Zephyr RTOS CVE-2026-12052

Physical USB connection between an attacker-controlled USB host (or USB interposer) and the target Zephyr device is required - there is no network-reachable attack surface. The device firmware must be compiled with both the device_next USB stack and the CDC NCM class enabled; this is an opt-in build configuration controlled by Kconfig, not present in all Zephyr images. Once USB enumeration occurs, no authentication or credentials are required - the wLength field is sourced from the USB SETUP packet and processed before any class-level gating. The written overflow content is fixed device constants (not attacker-supplied), which prevents arbitrary memory write exploitation and confines impact to heap metadata corruption and USB stack DoS. Devices built without CDC NCM support, or using the legacy USB device stack rather than device_next, are not affected by this vulnerability.

The CVSS 5.2 score with AV:P accurately reflects the practical attack surface - physical USB connection to the target device is mandatory, which is a meaningful barrier in most deployment models. EPSS data was not provided in the input and cannot be inferred. This CVE is not listed in CISA KEV, and no public exploit code has been identified at time of analysis. The overflow is bounded at a maximum of 27 bytes and writes only fixed, attacker-uncontrollable device constants, which substantially constrains exploitability beyond DoS; achieving reliable code execution from this primitive would require deep knowledge of the heap layout. The CDC NCM class is an opt-in build-time component of the device_next stack, not universally present in all Zephyr firmware images, which meaningfully narrows the exposed population beyond what the wildcard CPE version range implies. CVSS I:L appears slightly generous given that written content is not attacker-controlled, but heap metadata corruption does represent a real, if bounded, integrity impact. Real-world priority is moderate: the physical access prerequisite reduces urgency for most deployments, but USB peripheral products where untrusted parties may connect a host - public kiosks, industrial HMIs, shared lab equipment - warrant prompt patching.

An attacker with physical access to a deployed Zephyr device - using a laptop acting as a USB host, a commercial USB interposer, or a crafted USB peripheral - enumerates the device and issues a standard CDC NCM GET_NTB_PARAMETERS control request with the wLength field in the SETUP packet set to 1. The usbd_cdc_ncm_cth handler allocates a 1-byte response buffer and then copies the full 28-byte ntb_parameters structure into it, overwriting 27 bytes of adjacent udc_ep_pool metadata and crashing the device USB stack. No public exploit code has been identified, but the attack requires only standard USB host capabilities and knowledge of CDC NCM protocol structure.