CVE-2026-12052

Name of the Vulnerable Software and Affected Versions Zephyr (affected versions not specified)

Description An out-of-bounds write exists in the USB device-side CDC NCM class control-to-host handler usbd cdc ncm cth within the subsys/usb/device next/class/usbd cdc ncm.c file. The issue occurs when the handler processes GET NTB PARAMETERS and GET NTB INPUT SIZE class requests. The handler copies a fixed-size response structure into the control DATA IN buffer using net buf add mem(), ignoring the wLength value provided by the host. Since the buffer is allocated based on the host-supplied wLength, a host can trigger a memory overflow of up to 27 bytes by specifying a wLength smaller than the response structure. This can be exploited without authentication by any host or USB interposer the device enumerates against, leading to memory corruption of adjacent allocations and metadata in the udc ep pool, which primarily results in a denial of service of the USB stack.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.