Description
The USB device-side CDC NCM class control-to-host handler usbd_cdc_ncm_cth in subsys/usb/device_next/class/usbd_cdc_ncm.c builds a fixed-size response for the GET_NTB_PARAMETERS (28-byte struct ntb_parameters) and GET_NTB_INPUT_SIZE (8-byte struct ntb_input_size) class requests and copies the whole structure into the control DATA IN buffer with net_buf_add_mem(buf, ..., sizeof(...)), ignoring the host-supplied wLength.

The control DATA IN buffer is allocated by the USB stack with a capacity of exactly wLength bytes (usbd_ep_ctrl_data_in_alloc -> udc_ctrl_data_alloc -> net_buf_alloc_len(&udc_ep_pool, wLength); no round-up is applied for the IN endpoint). Because net_buf_add_mem/net_buf_simple_add only bounds the copy with an __ASSERT_NO_MSG, which is compiled out in production builds, a host that issues one of these standard CDC NCM control requests with a wLength smaller than the response structure (e.g. wLength = 1) causes the handler to memcpy up to 27 bytes past the end of the allocated pool buffer.

The request fields come straight from the USB SETUP packet, so any host (or USB interposer) the Zephyr device enumerates against can trigger the overflow with no authentication once an image built with the device_next USB stack and the CDC NCM class is connected. The out-of-bounds write corrupts adjacent allocations and metadata in the shared udc_ep_pool, primarily causing memory corruption and denial of service of the USB stack; the overflow length is bounded (<= 27 bytes) and the written content is fixed device constants, and the bug reads nothing back so there is no information disclosure. The fix clamps the copy with MIN(sizeof(...), setup->wLength), matching the existing CDC ACM handler.
Published: 2026-08-11
Score: 5.2 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An out‑of‑bounds write occurs in the CDC NCM control‑to‑host handler when the host requests a response length smaller than the size of the fixed response structure. The USB stack copies the entire structure to a buffer that was allocated with exactly the host‑supplied wLength, causing a write up to 27 bytes beyond the allocated area. Because the overrun corrupts adjacent memory in the USB control pool, the device can be destabilized and may become unresponsive, producing a denial‑of‑service condition. The flaw is a classic buffer overflow (CWE‑787) and does not disclose information or allow remote code execution. The bug is triggered by any host that issues the standard GET_NTB_PARAMETERS or GET_NTB_INPUT_SIZE requests without authentication, so any connected USB host or interposer can exploit it.

Affected Systems

The vulnerability affects devices running the Zephyr RTOS using the device_next USB stack and the CDC NCM class implementation in subsys/usb/device_next/class/usbd_cdc_ncm.c. The issue impacts any build that includes this code path, regardless of the device’s top‑level firmware version; the exact affected Zephyr versions are not specified.

Risk and Exploitability

The CVSS score of 5.2 places the vulnerability in the low‑to‑medium severity range. EPSS is not available, but the lack of authentication and the ability to trigger the overflow from any host imply a realistic threat to any exposed USB device. The vulnerability is not listed in the CISA KEV catalog. An attacker can exploit the flaw simply by connecting a malicious USB host; no additional credentials or specialized hardware are required. The impact is limited to memory corruption and a potential DoS of the USB stack, but could serve as a foothold for more advanced attacks if additional vulnerabilities exist.

Generated by OpenCVE AI on August 11, 2026 at 07:52 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the Zephyr firmware to the latest release that includes the commit c49b758d87914e185ff611e93473bf8ec84a378a, which limits the copy to the minimum of the structure size and the supplied wLength.
  • Rebuild and redeploy the device firmware after applying the patch to ensure the new code is running.
  • If a firmware update is not immediately possible, disable or remove the CDC NCM class from the USB stack to prevent the overflow from being reachable.

Generated by OpenCVE AI on August 11, 2026 at 07:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 11 Aug 2026 07:45:00 +0000

Type Values Removed Values Added
First Time appeared Zephyrproject
Zephyrproject zephyr
Vendors & Products Zephyrproject
Zephyrproject zephyr

Tue, 11 Aug 2026 06:00:00 +0000

Type Values Removed Values Added
Description The USB device-side CDC NCM class control-to-host handler usbd_cdc_ncm_cth in subsys/usb/device_next/class/usbd_cdc_ncm.c builds a fixed-size response for the GET_NTB_PARAMETERS (28-byte struct ntb_parameters) and GET_NTB_INPUT_SIZE (8-byte struct ntb_input_size) class requests and copies the whole structure into the control DATA IN buffer with net_buf_add_mem(buf, ..., sizeof(...)), ignoring the host-supplied wLength. The control DATA IN buffer is allocated by the USB stack with a capacity of exactly wLength bytes (usbd_ep_ctrl_data_in_alloc -> udc_ctrl_data_alloc -> net_buf_alloc_len(&udc_ep_pool, wLength); no round-up is applied for the IN endpoint). Because net_buf_add_mem/net_buf_simple_add only bounds the copy with an __ASSERT_NO_MSG, which is compiled out in production builds, a host that issues one of these standard CDC NCM control requests with a wLength smaller than the response structure (e.g. wLength = 1) causes the handler to memcpy up to 27 bytes past the end of the allocated pool buffer. The request fields come straight from the USB SETUP packet, so any host (or USB interposer) the Zephyr device enumerates against can trigger the overflow with no authentication once an image built with the device_next USB stack and the CDC NCM class is connected. The out-of-bounds write corrupts adjacent allocations and metadata in the shared udc_ep_pool, primarily causing memory corruption and denial of service of the USB stack; the overflow length is bounded (<= 27 bytes) and the written content is fixed device constants, and the bug reads nothing back so there is no information disclosure. The fix clamps the copy with MIN(sizeof(...), setup->wLength), matching the existing CDC ACM handler.
Title Out-of-bounds write in USB CDC NCM control handler when host wLength is smaller than the response
Weaknesses CWE-787
References
Metrics cvssV3_1

{'score': 5.2, 'vector': 'CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H'}

Subscriptions

Zephyrproject Zephyr
cve-icon MITRE

Status: PUBLISHED

Assigner: zephyr

Published:

Updated: 2026-08-11T05:51:40.540Z

Reserved: 2026-06-11T22:20:55.999Z

Link: CVE-2026-12052

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-11T08:00:03Z

Weaknesses