NXP has 4 CVEs on record. 4 were published in the last 90 days. The busiest recent month was October 2026 with 4. The median CVSS is 5.5 (medium). Most affected products: mcuxsdk-middleware-usb (2), MQX (1), NxpNfcRdLib (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 5.5
- Publish → KEV
- —
- Last 90 days
- 4 prev 0
Worst active — by depth score
CVE-2026-116488Medium· 6.8NXP MCUXpresso SDK USB Middleware before 2.13.0 Heap Overflow via Host Class Drivers49CVE-2026-116487Medium· 4.6NXP MCUXpresso SDK USB Middleware before 2.13.0 RNDIS Out-of-Bounds Read37CVE-2017-20283Medium· 6.5NXP MQX Classic before 5.0 contains an out-of-bounds write vulnerability in the RTCS UDP recvfrom() implementation36CVE-2026-87726Low· 3.9Insufficient API bounds checking in phalFelica in NXP NXPNfcRdLib RC663 through 07.14.00_Pub may allow an attacker with privileges or an untrusted third party to access unintended memory regions, potentially leading to limited loss of co…21
NXP vulnerabilities
CVEs affecting NXP, newest first. Open any entry for full detail, references, and exploit status.
4 CVEsRSS
CVE-2026-116488Medium· 6.8PoCNXP MCUXpresso SDK USB Middleware before 2.13.0 Heap Overflow via Host Class Drivers
NXP MCUXpresso SDK USB middleware (mcuxsdk-middleware-usb) before 2.13.0 contains a heap buffer overflow in host audio, video and CDC class drivers that trust device-supplied bNumEndpoints and bLength values. A malicious USB device can s…
CVE-2026-116487Medium· 4.6PoCNXP MCUXpresso SDK USB Middleware before 2.13.0 RNDIS Out-of-Bounds Read
NXP MCUXpresso SDK USB middleware (mcuxsdk-middleware-usb) before 2.13.0 contains an out-of-bounds read vulnerability in USB_DeviceCdcRndisSetCommand() that trusts a host-supplied informationBufferOffset. A malicious USB host can send RN…
CVE-2017-20283Medium· 6.5NXP MQX Classic before 5.0 contains an out-of-bounds write vulnerability in the RTCS UDP recvfrom() implementation
NXP MQX Classic before 5.0 contains an out-of-bounds write vulnerability in the RTCS UDP recvfrom() implementation. Improper enforcement of the application-supplied receive buffer length may allow a crafted UDP packet to overflow the des…
CVE-2026-87726Low· 3.9Insufficient API bounds checking in phalFelica in NXP NXPNfcRdLib RC663 through 07.14.00_Pub may allow an attacker with privileges or an untrusted third party to access unintended memory regions, potentially leading to limited loss of co…
Insufficient API bounds checking in phalFelica in NXP NXPNfcRdLib RC663 through 07.14.00_Pub may allow an attacker with privileges or an untrusted third party to access unintended memory regions, potentially leading to limited loss of co…