A heap buffer overflow exists in the host audio, video and CDC class drivers of the NXP MCUXpresso SDK USB middleware before version 2.13.0. The flaw arises because the code trusts the bNumEndpoints and bLength values supplied by a connected USB device, and a malicious device can craft descriptors that overwrite memory past the fixed-size epList array. The result is corruption of heap memory which can enable arbitrary code execution or cause a denial of service by crashing the host firmware.

The vulnerability affects the NXP MCUXpresso SDK USB Middleware, specifically any build that uses the mcuxsdk-middleware-usb prior to release 2.13.0. Devices or projects that compile against the included host drivers for audio, video or CDC classes and run on embedded hardware connected to USB are impacted.

The CVSS score of 7 indicates a high severity vulnerability. The EPSS score is not available, and it is not listed in the CISA KEV catalog, suggesting there is no confirmed widespread exploitation yet. However, the attack requires a malicious USB device to be connected to the host. Because the flaw is a heap overflow that can lead to code execution, it represents a severe risk to confidentiality, integrity, and availability of the affected device.