# CVE-2026-18413: NXP MCUX LPADC driver buffer overflow in ADC sampling

Source: https://junglewise.ai/threats/cve-2026-18413-the-adc-api-requires-each-driver-to-reject-a-sampling-sequence  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-28. Updated: 2026-09-28  
License: CC BY 4.0 with a link back

CVE-2026-18413 · Severity: high · CVSS 7.8 · Published 2026-09-28

The NXP MCUX LPADC driver in Zephyr fails to validate buffer sizes before writing ADC samples, allowing unbounded memory writes. An unprivileged user-mode thread with access to an LPADC device can request far more samples than allocated, causing the driver to write past the buffer boundary in kernel mode. This results in corruption of kernel memory, adjacent partitions, and thread stacks, enabling privilege escalation and denial-of-service attacks.

Technologies: [Zephyr Project Zephyr RTOS](https://junglewise.ai/threats/technologies/zephyr). Vendors: [NXP](https://junglewise.ai/threats/vendors/nxp), [Zephyr Project](https://junglewise.ai/threats/vendors/zephyr-project).

## Quick answers

**Is CVE-2026-18413 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-18413 being exploited in the wild.

**How severe is CVE-2026-18413?** High severity, with a CVSS score of 7.8, published 28 September 2026.

**Which products and versions are affected?** NXP MCUX LPADC driver Zephyr versions prior to the fix in drivers/adc/adc_mcux_lpadc.c and drivers/adc/adc_common.c; Zephyr Project Zephyr RTOS Versions with NXP MCUX LPADC driver and CONFIG_USERSPACE enabled.

**Is there a fix for CVE-2026-18413?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-18413 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-18413?** Check whether you run NXP MCUX LPADC driver or Zephyr Project Zephyr RTOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in mcux_lpadc_start_read() which does not validate that the supplied buffer is large enough for the requested sample count before assigning it to data->buffer. Unbounded writes then occur in the interrupt handler (mcux_lpadc_isr()) or DMA callback (mcux_lpadc_dma_callback()) for each converted sample. On CONFIG_USERSPACE builds, a user-mode thread can request channels * 65536 samples into a minimal buffer, walking the write pointer into kernel memory outside the user partition's MPU-protected domain.

## Affected products

- NXP MCUX LPADC driver Zephyr versions prior to the fix in drivers/adc/adc_mcux_lpadc.c and drivers/adc/adc_common.c
- Zephyr Project Zephyr RTOS Versions with NXP MCUX LPADC driver and CONFIG_USERSPACE enabled

## Timeline

- 2026-09-28: disclosed

## Related threats

- [Zephyr ICMP integer underflow in IPv4 option handling](https://junglewise.ai/threats/cve-2026-126957-an-integer-underflow-in-zephyr-s-ipv4-option-handling-allows-a)
- [Zephyr RTOS simulated EEPROM driver integer overflow in range validation](https://junglewise.ai/threats/cve-2026-90833-the-simulated-eeprom-driver-validated-access-ranges-in-eeprom)
- [Zephyr entropy-device uninitialized read in random number generation](https://junglewise.ai/threats/cve-2026-87043-the-entropy-device-random-number-generator-in-subsys-random)
- [Zephyr CAN RX filter use-after-free in can_add_rx_filter_msgq()](https://junglewise.ai/threats/cve-2026-85035-the-can-add-rx-filter-msgq-system-call-installs-a-can-rx-filter)
- [Zephyr GPIO syscall pin validation bypass](https://junglewise.ai/threats/cve-2026-82961-the-gpio-syscall-handlers-in-drivers-gpio-gpio-handlers-c-did-not)