The vulnerability exists in the usbd_cdc_ncm_cth handler in Zephyr's USB CDC NCM class implementation. It builds fixed-size responses for GET_NTB_PARAMETERS and GET_NTB_INPUT_SIZE requests and copies the entire structure into the control DATA IN buffer using net_buf_add_mem without checking the host-supplied wLength. The buffer is allocated exactly to wLength bytes, so if wLength is smaller than the response size, this results in an out-of-bounds write of up to 27 bytes past the buffer. The overflow corrupts adjacent memory in the shared udc_ep_pool, causing memory corruption and denial of service of the USB stack. The overflow length is bounded and the data written is fixed device constants, so there is no information disclosure. The vulnerability can be triggered by any host or USB interposer without authentication. The fix involves clamping the copy size to the minimum of the response size and wLength, consistent with the CDC ACM handler.

This vulnerability allows an unauthenticated USB host to cause memory corruption in the Zephyr USB stack, leading to denial of service of the USB device's USB stack. The out-of-bounds write is limited to 27 bytes and writes fixed device constants, so it does not lead to information disclosure. There is no indication of remote code execution or privilege escalation. The impact is primarily denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix clamps the copy size to the minimum of the response size and the host-supplied wLength, preventing the overflow. Until an official fix is available, avoid connecting Zephyr devices running affected versions to untrusted USB hosts or USB interposers that could send malformed CDC NCM requests.