Rt Thread CVE-2025-5865

The CVSS 3.1 vector (AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates moderate attack complexity with adjacency-level network access requirements and low privilege escalation needed. The score of 8.0 reflects high impact across confidentiality, integrity, and availability. However, the attack vector (AV:A - adjacent network) and privilege requirement (PR:L - low privilege) significantly constrain real-world exploitability compared to network-accessible vulnerabilities. The memory corruption nature suggests high technical impact if exploited successfully. Without disclosed EPSS scores, KEV status confirmation, or public POC availability, the practical exploitation probability appears moderate—this requires legitimate local/adjacent access and existing user privileges. The vulnerability is serious for networked IoT/embedded deployments where multiple processes or adjacent devices may be untrusted, but is less critical for single-user or isolated systems. Organizations running RT-Thread 5.1.0 in multi-tenant or exposed network environments should treat this as high priority.

An authenticated attacker with local user-level access to an RT-Thread 5.1.0 system (or adjacent network access in multi-process IoT scenarios) crafts a malicious application that calls select() with a specially crafted timeout parameter pointing to an invalid or out-of-bounds memory address. The lwp syscall handler fails to validate this pointer before dereferencing it in kernel mode, causing either: (1) out-of-bounds memory read/write corrupting kernel data structures, (2) kernel panic/DoS via access violation, or (3) potential code execution if the attacker can overwrite function pointers or kernel code. For example, an IoT device running RT-Thread with multiple user applications might have one compromised app exploiting this to corrupt the kernel's task control block, affecting all running processes. No public POC is known, but the straightforward nature of the bug (missing bounds check on a syscall parameter) means exploitation would be relatively straightforward once details are widely known.