Threats tagged 'ghsa-6rvq-9jq9-prp3'

NXP MCUXpresso SDK USB middleware versions before 2.13.0 contain a heap buffer overflow vulnerability in the host audio, video, and CDC class drivers. This flaw arises because the drivers trust device-supplied bNumEndpoints and bLength values without proper validation. A malicious USB device can exploit this by supplying crafted descriptors that overflow the fixed-size epList array, leading to heap memory corruption. This can result in code execution or denial of service on the affected system.