CVE-2026-14606
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
A security flaw in RT-Thread up to version 5.0.2 affects the CAN_Receive function in the SWM341.h file of the SWM341 CAN Handler component. A local attacker can trigger a stack-based buffer overflow through data manipulation. A public exploit is available for attacks.
Risk Assessment
The risk involves potential local code execution or system crash by an attacker with local access, which could lead to device compromise or denial of service.
Recommendation
Immediately update RT-Thread to a version above 5.0.2 if available, or apply temporary mitigations to restrict local access to the system.
Other vulnerabilities in RT-Thread
See all- CVE-2026-14629Medium
A flaw in RT-Thread up to version 5.2.2 affects the read/write/sys_ioctl functions in components/lwp/lwp_syscall.c. Parameter manipulation can cause a divide-by-zero error, allowing remote attacks. The exploit is published and may be used.
- CVE-2026-14607Medium
A weakness has been identified in RT-Thread up to version 5.0.2 in the function sys_getaddrinfo in file components/lwp/lwp_syscall.c. Manipulation of the ai_addr argument can lead to memory corruption. The attack requires local access and the exploit is publicly available.
- CVE-2026-14605High
A stack-based buffer overflow vulnerability was found in RT-Thread up to version 5.0.2 in the ls1c CAN Handler component's recvmsg function. The attack requires local access and the exploit is publicly available.
Original NVD description (English source)
A security flaw has been discovered in RT-Thread up to 5.0.2. Affected by this issue is the function CAN_Receive in the library bsp/synwit/libraries/SWM341_CSL/CMSIS/DeviceSupport/SWM341.h of the component SWM341 CAN Handler. Performing a manipulation results in stack-based buffer overflow. The attack needs to be approached locally. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.