Memory Corruption Vulnerability in Zephyr USB Stack's CDC NCM Class

CVE-2026-12052

What is CVE-2026-12052?

A vulnerability in the USB device-side CDC NCM class control-to-host handler allows for a potential memory corruption when handling specific control requests. The handler constructs fixed-size responses for the GET_NTB_PARAMETERS and GET_NTB_INPUT_SIZE requests, copying data to a control buffer without adequately considering the specified wLength from the host. This oversight enables an out-of-bounds write, potentially leading to corruption of adjacent memory allocations in the USB stack. Specifically, if a host requests a response length smaller than what is returned (e.g., wLength = 1), up to 27 bytes can be written beyond allocated memory. This results in memory corruption and can cause denial of service for devices using the affected USB stack configuration. The issue is patched by restricting the copy length to the lesser of the required size and the provided wLength.

References