CVE-2026-12052 zephyrproject CVE debrief

Who should care

Users of the Zephyr device_next USB stack, particularly those using the CDC NCM class, should review and apply patches or mitigations. Affected operators, platforms, and security teams need to prioritize patching and monitor for potential impacts. Vulnerability management and security teams should track exceptions, retest remediated assets, and ensure evidence of patching is documented. Asset inventory and change management processes should be updated to reflect the risk and required actions for exposed systems. Compensating controls should be reviewed for exposed systems while remediation is scheduled and verified. Monitoring and detection capabilities should be checked for potential denial of service attacks. Rollback and change window planning should consider the risk of exposure and the need for swift remediation. Source tracking and incident response plans should be updated to address potential exploitation attempts. This affects organizations using Zephyr device_next USB stack with CDC NCM class, requiring prompt review and action from operators, security teams, and vulnerability management processes to mitigate potential denial of service and memory corruption risks. Managed environment owners must confirm affected deployments and assign follow-up responsibilities. Security teams should integrate this vulnerability into their monitoring and detection workflows to identify potential exploitation attempts and verify the effectiveness of compensating controls and patches. Asset inventory and change management processes must be updated to reflect the risk and required actions for exposed systems, ensuring that security patches are applied promptly and that exceptions are tracked and addressed. The CDC NCM class control-to-host handler's vulnerability necessitates immediate attention from operators and security teams to prevent potential disruptions and data corruption. The USB stack's memory corruption vulnerability requires a thorough review of compensating controls, monitoring, and asset inventory processes to ensure comprehensive mitigation of the risk. Security teams must prioritize patching and verify the effectiveness of implemented mitigations to avoid

Technical summary

The USB device-side CDC NCM class control-to-host handler usbd_cdc_ncm_cth in subsys/usb/device_next/class/usbd_cdc_ncm.c builds a fixed-size response for the GET_NTB_PARAMETERS and GET_NTB_INPUT_SIZE class requests and copies the whole structure into the control DATA IN buffer with net_buf_add_mem(buf, ..., sizeof(...)), ignoring the host-supplied wLength. The control DATA IN buffer is allocated by the USB stack with a capacity of exactly wLength bytes, and no round-up is applied for the IN endpoint. A host that issues one of these standard CDC NCM control requests with a wLength smaller than the response structure causes the handler to memcpy up to 27 bytes past the end of the allocated pool buffer.

Defensive priority

High

Recommended defensive actions

• Review and apply the patch provided by the vendor
• Implement additional input validation and bounds checking
• Monitor USB stack logs for potential denial of service attacks
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability is caused by the handler's failure to validate the host-supplied wLength, allowing an out-of-bounds write. The fix clamps the copy with MIN(sizeof(...), setup->wLength). Evidence is limited to public CVE details and device_next USB stack specifics. Defenders should verify patch application, review USB stack logs for anomalies, and monitor for potential denial of service attacks. Additional verification tasks include checking for affected product deployments and reviewing compensating controls.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.