EUVD-2026-97359
GHSA-x4hq-c3c6-m368
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessConnect malicious USB host to device
-
DeliveryHost configures CDC virtual COM device
-
ExploitDriver aliases ring buffer as Serial V2 FIFO
-
ExecutionWrite past ring buffer corrupts vcom struct
-
ImpactInvalid rt_free() on close crashes device (DoS)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Type safety enforcement
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires physical USB connectivity: the attacker must connect a USB host to an RT-Thread device operating as a USB CDC virtual COM (vcom) gadget using the LEGACY USB device stack (components/legacy/usb/usbdevice/class/cdc_vcom.c). The defect is specifically triggered when RT_USING_SERIAL_V2 is enabled, because _function_enable() aliases rx_ringbuffer as a Serial V2 rt_serial_rx_fifo; the overflow then occurs during host-driven CDC configuration and the invalid rt_free() occurs on port close. Limiting factors: physical access is mandatory (AV:P), the legacy USB CDC vcom class and Serial V2 build configuration must both be present, and impact is confined to denial of service - no code execution, data disclosure, or integrity compromise. |
| Impact | This is a medium-severity, low-operational-priority issue for most environments. The vendor-supplied CVSS 4.0 vector (AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H, base 5.1) is internally consistent with the description: exploitation requires PHYSICAL attack access (AV:P) because an attacker must connect a USB host to the RT-Thread device acting as a USB CDC gadget, and the only impact is availability (VA:H) - a crash/denial of service via type confusion (CWE-843), with no confidentiality or integrity loss (VC:N/VI:N). No EPSS score was provided in the input, so exploitation-probability cannot be weighed; no CISA KEV listing and no public POC were supplied, so there is no public exploit identified at time of analysis. The signals do not conflict: a physical-access, DoS-only RTOS driver bug is genuinely a lower real-world priority than its CWE class might suggest, and the absence of EPSS/KEV/POC reinforces that this is not an actively weaponized, widespread threat. It matters most in deployments where untrusted USB hosts can physically connect to an RT-Thread device running the legacy USB CDC vcom driver with Serial V2 enabled. |
| Exploit ScenarioDerived | An attacker with physical access connects a malicious or specially-configured USB host to an embedded device running RT-Thread's legacy USB CDC virtual COM driver. During CDC device configuration/enumeration, the driver treats the rx_ringbuffer as a Serial V2 rt_serial_rx_fifo, causing writes past the ring buffer into adjacent struct vcom members and an invalid rt_free() on close, crashing the device. No public exploit code was identified in the provided data, and the physical attack vector (AV:P) limits this to hands-on access to the target. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 12, 2026
Memory corruption in the legacy USB CDC virtual COM (vcom) driver shipped in RT-Thread through 5.3.0 lets a physically connected USB host trigger writes past the serial ring buffer and, on port close, an invalid rt_free(), causing denial of service on the affected device. Only builds that include components/legacy/usb/usbdevice/class/cdc_vcom.c and enable RT_USING_SERIAL_V2 are exposed; exploitation requires physical USB access (CVSS 3.1 AV:P, PR:N), and impact is limited to availability with no code execution, data disclosure, or integrity loss. No public exploit code has been identified at time of analysis and the issue is not listed as actively exploited, so this is a medium-severity, low-operational-priority item for most environments; an upstream fix exists (PR #11770 / commit ceef6e0c).
RemediationAI
Upstream fix available (PR/commit); released patched version not independently confirmed: apply commit ceef6e0ccd646aef61b907aeb9f29269d1caba50 (PR https://github.com/RT-Thread/rt-thread/pull/11770), which drops the serial_rx aliasing in _function_enable() and routes CDC receive data through the Serial V2 fifo only when config.rx_bufsz is non-zero, otherwise using the legacy embedded rx_ringbuffer, then rebuild firmware. If that update cannot be shipped immediately, two compensating controls are practical: build the BSP without RT_USING_SERIAL_V2 so the aliasing branch at cdc_vcom.c is compiled out and the legacy ring buffer path is used (trade-off: loses Serial V2 features and must be validated against other serial-dependent components), or exclude the legacy USB CDC vcom class from the build so the device no longer exposes a virtual COM gadget (trade-off: removes USB serial console/COM functionality entirely). Because the vector is physical (AV:P), additionally restrict physical USB port access to trusted hosts or disable USB device-mode CDC exposure in deployed units until the patch is applied; note that this does not protect field devices with accessible USB ports. Track the vendor issue at https://github.com/RT-Thread/rt-thread/issues/11739 and the advisory at https://www.vulncheck.com/advisories/rt-thread-through-5.3.0-memory-corruption-via-usb-cdc-vcom-driver for a tagged release containing the fix, and treat the vulnerability as denial-of-service only when triaging.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is a type confusion (CWE-843) in RT-Thread's legacy USB device stack. In _function_enable() of components/legacy/usb/usbdevice/class/cdc_vcom.c, the driver aliases its embedded ring buffer to the Serial V2 receive object by assigning data->serial.serial_rx = &data->rx_ringbuffer. Under RT_USING_SERIAL_V2 the serial framework expects serial_rx to reference a struct rt_serial_rx_fifo (whose first member is an rt_ringbuffer, followed by additional fifo bookkeeping fields), so code paths that treat serial_rx as an rt_serial_rx_fifo operate on a much smaller object than expected. When a connected USB host configures the CDC device, host-driven receive handling writes through the mis-typed pointer past the end of the ring buffer into adjacent struct vcom members, and the teardown path later issues an rt_free() against memory that was never heap-allocated in that form. The upstream patch referenced by this CVE removes the aliasing, introduces a notify_rx/RX-indication split, and updates both the EP-OUT handler and _vcom_getc() so that data is placed in the Serial V2 fifo only when data->serial.config.rx_bufsz != 0 and otherwise falls back to the legacy embedded rx_ringbuffer, eliminating the out-of-bounds writes and the invalid free.
Know when Rt Thread gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
USB host must be physically connected (AV:P) and no credentials are needed (PR:N/UI:N); impact is a crash only, so C:N/I:N/A:H.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
RT-Thread through 5.3.0 contains a memory corruption vulnerability in the legacy USB CDC virtual COM port driver that aliases rx_ringbuffer as a Serial V2 rt_serial_rx_fifo in _function_enable(). A connected USB host configuring the CDC device triggers writes past the ring buffer into struct vcom members and an invalid rt_free() on close, causing denial of service.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Critical memory corruption vulnerability in RT-Thread 5.1.0's sys_select syscall handler that allows authenticated local
Critical null pointer dereference vulnerability in RT-Thread 5.1.0's lwp_syscall.c csys_sendto function, allowing authen
Critical memory corruption vulnerability in RT-Thread 5.1.0's sys_recvfrom syscall handler that allows authenticated loc
A security vulnerability in A vulnerability classified as critical (CVSS 8.0). Risk factors: public PoC available.
Critical array index validation vulnerability in RT-Thread 5.1.0's signal mask syscall handler that allows authenticated
A vulnerability, which was classified as critical, was found in RT-Thread up to 5.1.0. This affects the function sys_dev
Stack-based buffer overflow in RT-Thread RTOS (versions up to and including 5.0.2) affects the CAN_Receive function with
Stack-based buffer overflow in RT-Thread RTOS (versions up to and including 5.0.2) affects the recvmsg function within t
A stack buffer overflow occurs in net/at/src/at_server.c in RT-Thread through 5.0.2. Rated critical severity (CVSS 9.8),
Memory corruption in RT-Thread's Linux-compatible process (lwp) syscall layer allows a local low-privileged user to cras
A vulnerability classified as problematic was found in RT-Thread up to 5.1.0. Rated medium severity (CVSS 4.8), this vul
A buffer overflow occurs in utilities/rt-link/src/rtlink.c in RT-Thread through 5.0.2. Rated high severity (CVSS 8.8), t
Exploit-DB