Is CVE-2026-116487 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-116487?

CVE-2026-116487 has a CVSS v3 severity of MEDIUM (4.6).

Back

CVE-2026-116487

Description

NXP MCUXpresso SDK USB middleware (mcuxsdk-middleware-usb) before 2.13.0 contains an out-of-bounds read vulnerability in USB_DeviceCdcRndisSetCommand() that trusts a host-supplied informationBufferOffset. A malicious USB host can send RNDIS SET messages for OID_GEN_CURRENT_PACKET_FILTER or OID_802_3_MULTICAST_LIST with an out-of-range offset to read and disclose device memory.