# CVE-2026-19736: NXP MCUX TRNG entropy driver buffer overflow

Source: https://junglewise.ai/threats/cve-2026-19736-the-nxp-mcux-trng-entropy-driver-in-drivers-entropy-entropy-mcux  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-11. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-19736 · Severity: high · CVSS 7.8 · Published 2026-10-11

NXP's random number generator driver in Zephyr RTOS fails to properly validate request sizes, causing it to write far more data than requested into caller buffers. An unprivileged user with access to the entropy device can overwrite kernel memory on affected i.MX RT chips, or any kernel-mode caller requesting a non-word-aligned random number size risks memory corruption leading to crashes or privilege escalation.

Vendors: [NXP](https://junglewise.ai/threats/vendors/nxp).

## Quick answers

**Is CVE-2026-19736 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-19736 being exploited in the wild.

**How severe is CVE-2026-19736?** High severity, with a CVSS score of 7.8, published 11 October 2026.

**Which products and versions are affected?** NXP MCUX TRNG entropy driver Zephyr RTOS with MIMXRT595S, MIMXRT555S, MIMXRT533S, MIMXRT685S, MIMXRT633S.

**Is there a fix for CVE-2026-19736?** Yes: fixed in Zephyr RTOS with patched entropy_mcux_trng driver using bounce buffer for unaligned accesses. Until then: Disable hardware entropy via TRNG or restrict entropy device access to trusted kernel components only; alternatively, ensure all entropy requests use word-aligned (4-byte multiple) sizes from kernel code paths. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-19736 attacked?** It is attacked with local access or from the adjacent network, in device firmware.

**Am I affected by CVE-2026-19736?** Check whether you run NXP MCUX TRNG entropy driver at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Zephyr RTOS with patched entropy_mcux_trng driver using bounce buffer for unaligned accesses

Disable hardware entropy via TRNG or restrict entropy device access to trusted kernel components only; alternatively, ensure all entropy requests use word-aligned (4-byte multiple) sizes from kernel code paths.

## Technical details

The entropy_mcux_trng driver passes caller-supplied byte counts directly to the vendor SDK's TRNG_GetRandomData() routine without validating alignment. On i.MX RT5xx and RT6xx parts (which use TRNG_SW_HEALTH_TESTS), the SDK writes in 32-bit word increments and pads requests up to multiples of 128 bytes; a length underflow condition allows it to write well beyond the caller's buffer. The syscall handler only validates the requested length, not the actual write size, so unprivileged user-mode threads can specify misaligned lengths and corrupt kernel state in non-MMU systems where user and kernel SRAM are shared.

## Affected products

- NXP MCUX TRNG entropy driver Zephyr RTOS with MIMXRT595S, MIMXRT555S, MIMXRT533S, MIMXRT685S, MIMXRT633S

## Timeline

- 2026-10-11: disclosed