Is CVE-2026-116487 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-116487 being exploited in the wild.

How severe is CVE-2026-116487?

Medium severity, with a CVSS score of 4.6, published 26 October 2026.

Which products and versions are affected?

NXP MCUXpresso SDK USB middleware before 2.13.0.

Is there a fix for CVE-2026-116487?

Yes: fixed in 2.13.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-116487 attacked?

It is attacked from the adjacent network, in a software library.

Am I affected by CVE-2026-116487?

Check whether you run NXP MCUXpresso SDK USB middleware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-116487: NXP MCUXpresso SDK USB middleware out-of-bounds read in RNDIS

CVE-2026-116487 · Severity: medium · CVSS 4.6 · Published 2026-10-26

NXP's MCUXpresso SDK USB middleware implements Remote Network Driver Interface Specification (RNDIS) support for embedded devices. A malicious USB host can send specially crafted network configuration commands that trigger an out-of-bounds memory read, potentially exposing sensitive device memory contents to the attacker.

Vendors: NXP.

Quick answers

Is CVE-2026-116487 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-116487 being exploited in the wild.
How severe is CVE-2026-116487?: Medium severity, with a CVSS score of 4.6, published 26 October 2026.
Which products and versions are affected?: NXP MCUXpresso SDK USB middleware before 2.13.0.
Is there a fix for CVE-2026-116487?: Yes: fixed in 2.13.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-116487 attacked?: It is attacked from the adjacent network, in a software library.
Am I affected by CVE-2026-116487?: Check whether you run NXP MCUXpresso SDK USB middleware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 2.13.0

Technical details

The vulnerability exists in USB_DeviceCdcRndisSetCommand() function, which processes RNDIS SET messages without validating the informationBufferOffset parameter supplied by the USB host. An attacker can craft OID_GEN_CURRENT_PACKET_FILTER or OID_802_3_MULTICAST_LIST messages with an out-of-range offset to read arbitrary memory. This requires the host to send crafted USB packets but no authentication or user interaction.

Affected products

NXP MCUXpresso SDK USB middleware before 2.13.0

Timeline

2026-10-26: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.