The vulnerability is an out‑of‑bounds read in NXP’s MCUXpresso SDK USB middleware function USB_DeviceCdcRndisSetCommand(). The function uses a host‑supplied informationBufferOffset without bounds checking, allowing a malicious USB host to send RNDIS SET messages for OID_GEN_CURRENT_PACKET_FILTER or OID_802_3_MULTICAST_LIST with an out‑of‑range offset. When processed, the SDK reads beyond the intended buffer and discloses portions of device memory, compromising confidentiality.

This flaw affects devices running the NXP MCUXpresso SDK USB middleware (mcuxsdk-middleware-usb) before version 2.13.0. The issue resides in the usb_device_cdc_rndis.c source and applies to all boards and chips that bundle this middleware.

The CVSS score of 5.1 indicates a medium severity vulnerability. EPSS is not available, so the exact likelihood cannot be quantified, but the absence of a KEV listing suggests no known widespread exploitation. The attack vector is inferred to be a remote USB host; a malicious host can trigger the read by sending crafted RNDIS packets, making the vulnerability exploitable in environments where the device is exposed to untrusted USB hosts.