CVE-2026-18413: NXP MCUX LPADC driver buffer overflow in ADC sampling

CVE-2026-18413 · Severity: high · CVSS 7.8 · Published 2026-09-28

The NXP MCUX LPADC driver in Zephyr fails to validate buffer sizes before writing ADC samples, allowing unbounded memory writes. An unprivileged user-mode thread with access to an LPADC device can request far more samples than allocated, causing the driver to write past the buffer boundary in kernel mode. This results in corruption of kernel memory, adjacent partitions, and thread stacks, enabling privilege escalation and denial-of-service attacks.

Technologies: Zephyr Project Zephyr RTOS. Vendors: NXP, Zephyr Project.

Quick answers

Is CVE-2026-18413 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-18413 being exploited in the wild.
How severe is CVE-2026-18413?
High severity, with a CVSS score of 7.8, published 28 September 2026.
Which products and versions are affected?
NXP MCUX LPADC driver Zephyr versions prior to the fix in drivers/adc/adc_mcux_lpadc.c and drivers/adc/adc_common.c; Zephyr Project Zephyr RTOS Versions with NXP MCUX LPADC driver and CONFIG_USERSPACE enabled.
Is there a fix for CVE-2026-18413?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-18413 attacked?
It is attacked with local access, in an operating system.
Am I affected by CVE-2026-18413?
Check whether you run NXP MCUX LPADC driver or Zephyr Project Zephyr RTOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in mcux_lpadc_start_read() which does not validate that the supplied buffer is large enough for the requested sample count before assigning it to data->buffer. Unbounded writes then occur in the interrupt handler (mcux_lpadc_isr()) or DMA callback (mcux_lpadc_dma_callback()) for each converted sample. On CONFIG_USERSPACE builds, a user-mode thread can request channels * 65536 samples into a minimal buffer, walking the write pointer into kernel memory outside the user partition's MPU-protected domain.

Affected products

  • NXP MCUX LPADC driver Zephyr versions prior to the fix in drivers/adc/adc_mcux_lpadc.c and drivers/adc/adc_common.c
  • Zephyr Project Zephyr RTOS Versions with NXP MCUX LPADC driver and CONFIG_USERSPACE enabled

Timeline

  • 2026-09-28: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.