CVE-2026-12052

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-12052", "assignerOrgId": "e2e69745-5e70-4e92-8431-deb5529a81ad", "state": "PUBLISHED", "assignerShortName": "zephyr", "dateReserved": "2026-06-11T22:20:55.999Z", "datePublished": "2026-08-11T05:51:40.540Z", "dateUpdated": "2026-11-04T04:59:19.497Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "e2e69745-5e70-4e92-8431-deb5529a81ad", "shortName": "zephyr", "dateUpdated": "2026-11-04T04:59:19.497Z"}, "title": "Out-of-bounds write in USB CDC NCM control handler when host wLength is smaller than the response", "descriptions": [{"lang": "en", "value": "The USB device-side CDC NCM class control-to-host handler usbd_cdc_ncm_cth in subsys/usb/device_next/class/usbd_cdc_ncm.c builds a fixed-size response for the GET_NTB_PARAMETERS (28-byte struct ntb_parameters) and GET_NTB_INPUT_SIZE (8-byte struct ntb_input_size) class requests and copies the whole structure into the control DATA IN buffer with net_buf_add_mem(buf, ..., sizeof(...)), ignoring the host-supplied wLength.\n\nThe control DATA IN buffer is allocated by the USB stack with a capacity of exactly wLength bytes (usbd_ep_ctrl_data_in_alloc -> udc_ctrl_data_alloc -> net_buf_alloc_len(&udc_ep_pool, wLength); no round-up is applied for the IN endpoint). Because net_buf_add_mem/net_buf_simple_add only bounds the copy with an __ASSERT_NO_MSG, which is compiled out in production builds, a host that issues one of these standard CDC NCM control requests with a wLength smaller than the response structure (e.g. wLength = 1) causes the handler to memcpy up to 27 bytes past the end of the allocated pool buffer.\n\nThe request fields come straight from the USB SETUP packet, so any host (or USB interposer) the Zephyr device enumerates against can trigger the overflow with no authentication once an image built with the device_next USB stack and the CDC NCM class is connected. The out-of-bounds write corrupts adjacent allocations and metadata in the shared udc_ep_pool, primarily causing memory corruption and denial of service of the USB stack; the overflow length is bounded (<= 27 bytes) and the written content is fixed device constants, and the bug reads nothing back so there is no information disclosure. The fix clamps the copy with MIN(sizeof(...), setup->wLength), matching the existing CDC ACM handler."}], "affected": [{"vendor": "zephyrproject", "product": "zephyr", "collectionURL": "https://github.com/zephyrproject-rtos/zephyr", "packageName": "zephyr", "defaultStatus": "unaffected", "programFiles": ["subsys/usb/device_next/class/usbd_cdc_ncm.c"], "versions": [{"version": "4.0.0", "status": "affected", "versionType": "semver", "lessThan": "4.3.2"}, {"version": "4.4.0", "status": "affected", "versionType": "semver", "lessThan": "4.4.2"}]}], "references": [{"url": "https://github.com/zephyrproject-rtos/zephyr/commit/c49b758d87914e185ff611e93473bf8ec84a378a", "name": "Fix commit", "tags": ["patch"]}, {"url": "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-vr4p-6rg5-qgpx", "name": "GHSA-vr4p-6rg5-qgpx"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "baseScore": 5.2, "baseSeverity": "MEDIUM"}}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "bounds", "cweId": "CWE-787", "type": "CWE"}]}], "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-11T17:01:33.666847Z", "id": "CVE-2026-12052", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-11T17:01:48.442Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-12052", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-11T17:01:33.666847Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-11T17:01:41.972Z"}}], "cna": {"title": "Out-of-bounds write in USB CDC NCM control handler when host wLength is smaller than the response", "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 5.2, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H"}}], "affected": [{"vendor": "zephyrproject", "product": "zephyr", "versions": [{"status": "affected", "version": "4.0.0", "lessThan": "4.3.2", "versionType": "semver"}, {"status": "affected", "version": "4.4.0", "lessThan": "4.4.2", "versionType": "semver"}], "packageName": "zephyr", "programFiles": ["subsys/usb/device_next/class/usbd_cdc_ncm.c"], "collectionURL": "https://github.com/zephyrproject-rtos/zephyr", "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/zephyrproject-rtos/zephyr/commit/c49b758d87914e185ff611e93473bf8ec84a378a", "name": "Fix commit", "tags": ["patch"]}, {"url": "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-vr4p-6rg5-qgpx", "name": "GHSA-vr4p-6rg5-qgpx"}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "The USB device-side CDC NCM class control-to-host handler usbd_cdc_ncm_cth in subsys/usb/device_next/class/usbd_cdc_ncm.c builds a fixed-size response for the GET_NTB_PARAMETERS (28-byte struct ntb_parameters) and GET_NTB_INPUT_SIZE (8-byte struct ntb_input_size) class requests and copies the whole structure into the control DATA IN buffer with net_buf_add_mem(buf, ..., sizeof(...)), ignoring the host-supplied wLength.\n\nThe control DATA IN buffer is allocated by the USB stack with a capacity of exactly wLength bytes (usbd_ep_ctrl_data_in_alloc -> udc_ctrl_data_alloc -> net_buf_alloc_len(&udc_ep_pool, wLength); no round-up is applied for the IN endpoint). Because net_buf_add_mem/net_buf_simple_add only bounds the copy with an __ASSERT_NO_MSG, which is compiled out in production builds, a host that issues one of these standard CDC NCM control requests with a wLength smaller than the response structure (e.g. wLength = 1) causes the handler to memcpy up to 27 bytes past the end of the allocated pool buffer.\n\nThe request fields come straight from the USB SETUP packet, so any host (or USB interposer) the Zephyr device enumerates against can trigger the overflow with no authentication once an image built with the device_next USB stack and the CDC NCM class is connected. The out-of-bounds write corrupts adjacent allocations and metadata in the shared udc_ep_pool, primarily causing memory corruption and denial of service of the USB stack; the overflow length is bounded (<= 27 bytes) and the written content is fixed device constants, and the bug reads nothing back so there is no information disclosure. The fix clamps the copy with MIN(sizeof(...), setup->wLength), matching the existing CDC ACM handler."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "bounds"}]}], "providerMetadata": {"orgId": "e2e69745-5e70-4e92-8431-deb5529a81ad", "shortName": "zephyr", "dateUpdated": "2026-11-04T04:59:19.497Z"}}}, "cveMetadata": {"cveId": "CVE-2026-12052", "state": "PUBLISHED", "dateUpdated": "2026-11-04T04:59:19.497Z", "dateReserved": "2026-06-11T22:20:55.999Z", "assignerOrgId": "e2e69745-5e70-4e92-8431-deb5529a81ad", "datePublished": "2026-08-11T05:51:40.540Z", "assignerShortName": "zephyr"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://github.com/zephyrproject-rtos/zephyr", "defaultStatus": "unaffected", "packageName": "zephyr", "product": "zephyr", "programFiles": ["subsys/usb/device_next/class/usbd_cdc_ncm.c"], "vendor": "zephyrproject", "versions": [{"lessThan": "4.3.2", "status": "affected", "version": "4.0.0", "versionType": "semver"}, {"lessThan": "4.4.2", "status": "affected", "version": "4.4.0", "versionType": "semver"}]}], "source": "vulnerabilities@zephyrproject.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The USB device-side CDC NCM class control-to-host handler usbd_cdc_ncm_cth in subsys/usb/device_next/class/usbd_cdc_ncm.c builds a fixed-size response for the GET_NTB_PARAMETERS (28-byte struct ntb_parameters) and GET_NTB_INPUT_SIZE (8-byte struct ntb_input_size) class requests and copies the whole structure into the control DATA IN buffer with net_buf_add_mem(buf, ..., sizeof(...)), ignoring the host-supplied wLength.\n\nThe control DATA IN buffer is allocated by the USB stack with a capacity of exactly wLength bytes (usbd_ep_ctrl_data_in_alloc -> udc_ctrl_data_alloc -> net_buf_alloc_len(&udc_ep_pool, wLength); no round-up is applied for the IN endpoint). Because net_buf_add_mem/net_buf_simple_add only bounds the copy with an __ASSERT_NO_MSG, which is compiled out in production builds, a host that issues one of these standard CDC NCM control requests with a wLength smaller than the response structure (e.g. wLength = 1) causes the handler to memcpy up to 27 bytes past the end of the allocated pool buffer.\n\nThe request fields come straight from the USB SETUP packet, so any host (or USB interposer) the Zephyr device enumerates against can trigger the overflow with no authentication once an image built with the device_next USB stack and the CDC NCM class is connected. The out-of-bounds write corrupts adjacent allocations and metadata in the shared udc_ep_pool, primarily causing memory corruption and denial of service of the USB stack; the overflow length is bounded (<= 27 bytes) and the written content is fixed device constants, and the bug reads nothing back so there is no information disclosure. The fix clamps the copy with MIN(sizeof(...), setup->wLength), matching the existing CDC ACM handler."}, {"lang": "es", "value": "El gestor de control a host de la clase CDC NCM del lado del dispositivo USB usbd_cdc_ncm_cth en subsys/usb/device_next/class/usbd_cdc_ncm.c construye una respuesta de tama\u00f1o fijo para las solicitudes de clase GET_NTB_PARAMETERS (estructura ntb_parameters de 28 bytes) y GET_NTB_INPUT_SIZE (estructura ntb_input_size de 8 bytes) y copia la estructura completa en el b\u00fafer de control DATA IN con net_buf_add_mem(buf, ..., sizeof(...)), ignorando el wLength proporcionado por el host.\n\nEl b\u00fafer de control DATA IN es asignado por la pila USB con una capacidad de exactamente wLength bytes (usbd_ep_ctrl_data_in_alloc -> udc_ctrl_data_alloc -> net_buf_alloc_len(&udc_ep_pool, wLength); no se aplica redondeo para el punto final IN). Debido a que net_buf_add_mem/net_buf_simple_add solo limita la copia con un __ASSERT_NO_MSG, que se compila fuera en las compilaciones de producci\u00f3n, un host que emite una de estas solicitudes de control est\u00e1ndar de CDC NCM con un wLength menor que la estructura de respuesta (por ejemplo, wLength = 1) hace que el gestor copie con memcpy hasta 27 bytes m\u00e1s all\u00e1 del final del b\u00fafer de pool asignado.\n\nLos campos de la solicitud provienen directamente del paquete USB SETUP, por lo que cualquier host (o interponedor USB) contra el que el dispositivo Zephyr se enumere puede activar el desbordamiento sin autenticaci\u00f3n una vez que se conecta una imagen construida con la pila USB device_next y la clase CDC NCM. La escritura fuera de l\u00edmites corrompe las asignaciones adyacentes y los metadatos en el udc_ep_pool compartido, causando principalmente corrupci\u00f3n de memoria y denegaci\u00f3n de servicio de la pila USB; la longitud del desbordamiento est\u00e1 limitada (menor o igual que 27 bytes) y el contenido escrito son constantes de dispositivo fijas, y el error no lee nada de vuelta, por lo que no hay revelaci\u00f3n de informaci\u00f3n. La soluci\u00f3n limita la copia con MIN(sizeof(...), setup -> wLength), coincidiendo con el gestor CDC ACM existente."}], "id": "CVE-2026-12052", "lastModified": "2026-11-04T05:18:37.827", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "PHYSICAL", "availabilityImpact": "HIGH", "baseScore": 5.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "version": "3.1"}, "exploitabilityScore": 0.9, "impactScore": 4.2, "source": "vulnerabilities@zephyrproject.org", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-12052", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-11T17:01:33.666847Z", "version": "2.0.3"}}]}, "published": "2026-08-11T06:17:12.747", "references": [{"source": "vulnerabilities@zephyrproject.org", "url": "https://github.com/zephyrproject-rtos/zephyr/commit/c49b758d87914e185ff611e93473bf8ec84a378a"}, {"source": "vulnerabilities@zephyrproject.org", "url": "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-vr4p-6rg5-qgpx"}], "sourceIdentifier": "vulnerabilities@zephyrproject.org", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "vulnerabilities@zephyrproject.org", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.0.0,4.4.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "zephyr", "source": "cna", "vendor": "zephyrproject"}, "product": "zephyr", "vendor": "zephyrproject"}], "created": "2026-08-11T07:30:03.125908+00:00", "updated": "2026-08-11T08:00:03.991650+00:00", "vendors": ["zephyrproject", "zephyrproject$PRODUCT$zephyr"]}