# CVE-2026-12052: Out-of-bounds write in USB CDC NCM control handler when host wLength is smaller than the response

Status: published. Published: 2026-08-11. Updated: 2026-11-04.

The USB device-side CDC NCM class control-to-host handler usbd_cdc_ncm_cth in subsys/usb/device_next/class/usbd_cdc_ncm.c builds a fixed-size response for the GET_NTB_PARAMETERS (28-byte struct ntb_parameters) and GET_NTB_INPUT_SIZE (8-byte struct ntb_input_size) class requests and copies the whole structure into the control DATA IN buffer with net_buf_add_mem(buf, ..., sizeof(...)), ignoring the host-supplied wLength.

The control DATA IN buffer is allocated by the USB stack with a capacity of exactly wLength bytes (usbd_ep_ctrl_data_in_alloc -> udc_ctrl_data_alloc -> net_buf_alloc_len(&udc_ep_pool, wLength); no round-up is applied for the IN endpoint). Because net_buf_add_mem/net_buf_simple_add only bounds the copy with an __ASSERT_NO_MSG, which is compiled out in production builds, a host that issues one of these standard CDC NCM control requests with a wLength smaller than the response structure (e.g. wLength = 1) causes the handler to memcpy up to 27 bytes past the end of the allocated pool buffer.

The request fields come straight from the USB SETUP packet, so any host (or USB interposer) the Zephyr device enumerates against can trigger the overflow with no authentication once an image built with the device_next USB stack and the CDC NCM class is connected. The out-of-bounds write corrupts adjacent allocations and metadata in the shared udc_ep_pool, primarily causing memory corruption and denial of service of the USB stack; the overflow length is bounded (<= 27 bytes) and the written content is fixed device constants, and the bug reads nothing back so there is no information disclosure. The fix clamps the copy with MIN(sizeof(...), setup->wLength), matching the existing CDC ACM handler.

## Remediation

- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: CNA: zephyr) — https://github.com/zephyrproject-rtos/zephyr/commit/c49b758d87914e185ff611e93473bf8ec84a378a

## Affected products and versions

- zephyrproject / zephyr (zephyr): ≥ 4.0.0; < 4.3.2 (affected, semver); ≥ 4.4.0; < 4.4.2 (affected, semver). Source: CNA: zephyr

## Severity and prioritization

- CVSS 3.1: 5.2 (medium); CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H; source: CNA: zephyr

- CVSS 3.1: 5.2 (medium); CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H; source: NVD: vulnerabilities@zephyrproject.org

- CISA KEV: No listing in collected sources

- EPSS: 0.27% as of 2026-11-03; percentile 18.60%

- SSVC: exploitation none; automatable no; technical impact partial; source ADP: CISA-ADP

- Weaknesses: CWE-787

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://github.com/zephyrproject-rtos/zephyr/commit/c49b758d87914e185ff611e93473bf8ec84a378a (CNA: zephyr; patch)

- https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-vr4p-6rg5-qgpx (CNA: zephyr)

- https://github.com/zephyrproject-rtos/zephyr/commit/c49b758d87914e185ff611e93473bf8ec84a378a (vulnerabilities@zephyrproject.org)

- https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-vr4p-6rg5-qgpx (vulnerabilities@zephyrproject.org)

## Provenance

- CNA: zephyr: https://www.cve.org/CVERecord?id=CVE-2026-12052; retrieved 2026-11-04; source updated 2026-11-04

- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-12052; retrieved 2026-11-04; source updated 2026-11-04

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2026-12052; retrieved 2026-11-04; source updated Not reported

Revision: fc6b0588f200214bc48094ad2190b08c1595ce1fed43d0718daca99c9d5b82c1

Canonical: https://y2.dev/cve/CVE-2026-12052

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.