Vendor
NXP vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 11 vulnerabilities in NXP: 4 in the last 7 days and 10 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-90591, was published on 9 November 2026. 5 vulnerabilities in the last four weeks, up 67% on the four before (3).
- Last 7 days
- 4
- Last 90 days
- 10
- Critical, all time
- 0
- Exploited in the wild
- 0
About NXP
NXP Semiconductors is a semiconductor manufacturer producing microcontrollers, processors, and wireless connectivity solutions.
Latest NXP vulnerabilities
- CVE-2026-90591: NXP ENET-QOS Ethernet driver DMA descriptor memory corruptionhighCVSS 7.5EPSS 0.3%
- CVE-2026-90590: NXP ENET QoS Ethernet driver denial of service via link flapmediumCVSS 6.5EPSS 0.2%
- CVE-2026-118786: NXP MCUXpresso SDK improper input validation in NSC veneer functionsmediumCVSS 6.8
- CVE-2026-118785: NXP MCUXpresso SDK TrustZone-M NSC veneer input validation bypassmediumCVSS 6.7
- CVE-2026-116488: NXP MCUXpresso SDK USB middleware heap buffer overflowmediumCVSS 6.8
- CVE-2026-116487: NXP MCUXpresso SDK USB middleware out-of-bounds read in RNDISmediumCVSS 4.6
- CVE-2026-75083: NXP KW41Z IEEE 802.15.4 driver buffer overflow in receive pathmediumCVSS 5.9EPSS 0.2%
- CVE-2026-19736: NXP MCUX TRNG entropy driver buffer overflowhighCVSS 7.8EPSS 0.1%
- CVE-2026-18413: NXP MCUX LPADC driver buffer overflow in ADC samplinghighCVSS 7.8
- CVE-2026-57014: NXP NCI HAL out-of-bounds write in NFC initializationhighCVSS 7.8EPSS 0.1%
- CVE-2025-29338: NXP moal.ko Wi-Fi driver stack buffer overflow in woal_init_module_paraminfoCVSS 7.8
Most severe NXP vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2026-19736: NXP MCUX TRNG entropy driver buffer overflowhighCVSS 7.8EPSS 0.1%
- CVE-2026-57014: NXP NCI HAL out-of-bounds write in NFC initializationhighCVSS 7.8EPSS 0.1%
- CVE-2026-18413: NXP MCUX LPADC driver buffer overflow in ADC samplinghighCVSS 7.8
- CVE-2026-90591: NXP ENET-QOS Ethernet driver DMA descriptor memory corruptionhighCVSS 7.5EPSS 0.3%
- CVE-2026-118786: NXP MCUXpresso SDK improper input validation in NSC veneer functionsmediumCVSS 6.8
- CVE-2026-116488: NXP MCUXpresso SDK USB middleware heap buffer overflowmediumCVSS 6.8
- CVE-2026-118785: NXP MCUXpresso SDK TrustZone-M NSC veneer input validation bypassmediumCVSS 6.7
- CVE-2026-90590: NXP ENET QoS Ethernet driver denial of service via link flapmediumCVSS 6.5EPSS 0.2%
- CVE-2026-75083: NXP KW41Z IEEE 802.15.4 driver buffer overflow in receive pathmediumCVSS 5.9EPSS 0.2%
- CVE-2026-116487: NXP MCUXpresso SDK USB middleware out-of-bounds read in RNDISmediumCVSS 4.6
Vulnerabilities per week
5 vulnerabilities in the last four weeks, up 67% on the four before (3). The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 0 | 0 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 0 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 1 | 0 | |
| 21 Sep 2026 | 0 | 0 | |
| 28 Sep 2026 | 1 | 0 | |
| 5 Oct 2026 | 1 | 0 | |
| 12 Oct 2026 | 1 | 0 | |
| 19 Oct 2026 | 0 | 0 | |
| 26 Oct 2026 | 2 | 0 | |
| 2 Nov 2026 | 2 | 0 | |
| 9 Nov 2026 | 2 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many NXP vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/vendors/nxp)<a href="https://junglewise.ai/threats/vendors/nxp"><img src="https://junglewise.ai/threats/vendors/nxp/badge.svg" alt="NXP vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/vendors/nxp.json, and this page as text at https://junglewise.ai/threats/vendors/nxp.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "NXP vulnerabilities", https://junglewise.ai/threats/vendors/nxp, 12 November 2026.