Integer Underflow Vulnerability in Huawei Device Management

CVE-2026-65200

What is CVE-2026-65200?

The Huawei device management process is susceptible to an integer underflow vulnerability when handling PLDM-over-MCTP and NCSI-over-MCTP responses. During the parsing of these responses, a critical flaw exists where the response length is adjusted without proper lower-bound checks. This can result in an undersized response that wraps the unsigned length difference, allowing the parser to read beyond the intended response buffer. Consequently, this vulnerability poses a risk to any PLDM endpoint or Huawei NIC connected to the internal management bus, as the issue exists within the foundational PLDM control class and the Huawei NCSI driver.

References