CVE-2026-108952
MediumCVSS 4.6Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
RT-Thread through 5.3.0 contains a memory corruption vulnerability in the legacy USB CDC virtual COM port driver that aliases rx_ringbuffer as a Serial V2 rt_serial_rx_fifo in _function_enable(). A connected USB host configuring the CDC device triggers writes past the ring buffer into struct vcom members and an invalid rt_free() on close, causing denial of service.
Risk Assessment
The risk includes system or service crashes (denial of service) due to memory corruption, potentially leading to disruptions in devices based on RT-Thread.
Recommendation
It is recommended to upgrade RT-Thread to a version newer than 5.3.0 and apply security patches for the USB CDC driver to prevent memory corruption.
Other vulnerabilities in RT-Thread
See all- CVE-2026-14629Medium
A flaw in RT-Thread up to version 5.2.2 affects the read/write/sys_ioctl functions in components/lwp/lwp_syscall.c. Parameter manipulation can cause a divide-by-zero error, allowing remote attacks. The exploit is published and may be used.
- CVE-2026-14607Medium
A weakness has been identified in RT-Thread up to version 5.0.2 in the function sys_getaddrinfo in file components/lwp/lwp_syscall.c. Manipulation of the ai_addr argument can lead to memory corruption. The attack requires local access and the exploit is publicly available.
- CVE-2026-14606High
A security flaw in RT-Thread up to version 5.0.2 affects the CAN_Receive function in the SWM341.h file of the SWM341 CAN Handler component. A local attacker can trigger a stack-based buffer overflow through data manipulation. A public exploit is available for attacks.
- CVE-2026-14605High
A stack-based buffer overflow vulnerability was found in RT-Thread up to version 5.0.2 in the ls1c CAN Handler component's recvmsg function. The attack requires local access and the exploit is publicly available.
Original NVD description (English source)
RT-Thread through 5.3.0 contains a memory corruption vulnerability in the legacy USB CDC virtual COM port driver that aliases rx_ringbuffer as a Serial V2 rt_serial_rx_fifo in _function_enable(). A connected USB host configuring the CDC device triggers writes past the ring buffer into struct vcom members and an invalid rt_free() on close, causing denial of service.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS