EUVD-2026-41562
GHSA-whcm-77gq-7fj3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local low-privilege access to device
-
DeliveryReach ls1c CAN recvmsg interface
-
ExploitSubmit oversized crafted CAN message
-
ExecutionOverflow fixed stack buffer
-
PersistOverwrite return address / corrupt stack
-
ImpactHijack control flow or crash device
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires that the target device actually runs RT-Thread (≤5.0.2) built with the Loongson LS1C board support package and its ls1c CAN driver (ls1c_can.h) - devices without this BSP or CAN handler are not exposed. The attacker needs local access with low privileges (CVSS PR:L, AV:L) sufficient to invoke the recvmsg call on the CAN interface with attacker-controlled message contents; no user interaction is required (UI:N). Limiting factors: exploitation is local-only (no network vector), is confined to the specific Loongson LS1C hardware/driver configuration rather than default RT-Thread builds, and depends on the attacker being able to submit crafted data through the CAN receive path. |
| Impact | Signals are moderate and partially conflicting. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H, base 7.1, with E:P/Proof-of-Concept) indicates local access and low privilege but full high impact to confidentiality, integrity, and availability. Public exploit code exists, which raises practical risk for anyone able to reach the CAN interface, but the local attack vector (AV:L) sharply limits remote mass-exploitation. There is no KEV listing and no EPSS value supplied, so widespread automated exploitation is not evidenced - realistic risk is targeted, requiring an attacker already local to the device or able to feed crafted CAN messages. Notably, exploitation depends entirely on a device actually using the Loongson LS1C BSP and its CAN driver, which is a narrow deployment slice of RT-Thread's overall install base. Net: a genuine memory-corruption bug worth patching for affected LS1C CAN deployments, but not a broad emergency given local-only vector and niche affected component. |
| Exploit ScenarioDerived | An attacker with local, low-privilege access to an RT-Thread device running the Loongson LS1C CAN driver invokes recvmsg on the CAN interface with a crafted message that exceeds the fixed stack buffer, overflowing it and overwriting the return address to hijack control flow or crash the device. Because public proof-of-concept exploit code exists (VulDB), the barrier to reproducing the overflow is low for someone already positioned on or adjacent to the device's CAN subsystem. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jul 03, 2026
Stack-based buffer overflow in RT-Thread RTOS (versions up to and including 5.0.2) affects the recvmsg function within the ls1c CAN handler (bsp/loongson/ls1cdev/libraries/ls1c_can.h) for the Loongson LS1C board support package. A local attacker with low privileges can manipulate the recvmsg call path to overflow a stack buffer, corrupting memory to achieve code execution or crash the device. Publicly available exploit code exists (VulDB), but there is no public exploit identified as actively used in the wild; this is not on CISA KEV, and no vendor patch has been identified as the vendor did not respond to disclosure.
Earlier versions of this analysis (2)
Stack-based buffer overflow in RT-Thread RTOS (versions through 5.0.2) affects the recvmsg function in the ls1c CAN driver (ls1c_can.h) for the Loongson LS1C board support package. A local, low-privileged attacker can corrupt the stack to achieve memory corruption with high confidentiality, integrity, and availability impact on the affected device. Publicly available exploit code exists, but there is no public exploit identified as being used in active attacks; the vendor was notified early and did not respond.
Local memory corruption in RT-Thread RTOS (versions up to and including 5.0.2) stems from a stack-based buffer overflow in the recvmsg function within the Loongson LS1C CAN driver (bsp/loongson/ls1cdev/libraries/ls1c_can.h). A low-privileged local attacker can trigger the overflow to corrupt stack memory, potentially achieving arbitrary code execution or crashing affected embedded boards. Publicly available exploit code exists (published via VulDB and the RT-Thread GitHub issue tracker), but there is no public exploit identified as actively exploited, and the vendor did not respond to the disclosure.
RemediationAI
No vendor-released patch identified at time of analysis - the vendor was contacted but did not respond, so no fixed version number can be cited. Track the upstream issue at https://github.com/RT-Thread/rt-thread/issues/11424 and the repository https://github.com/RT-Thread/rt-thread/ for a corrective commit or release. As specific compensating controls: on devices that do not require the Loongson LS1C CAN driver, exclude or disable the ls1c_can component from the build to remove the vulnerable recvmsg path entirely (trade-off: loss of CAN functionality on those boards); restrict which local processes/tasks can access the CAN socket interface so untrusted code cannot invoke recvmsg with crafted input (trade-off: requires privilege partitioning that many RTOS firmware images lack); and for physically exposed devices, control access to the CAN bus and enforce input validation/length checks on inbound CAN messages before they reach the driver. Where source access is available, add bounds checking to the recvmsg buffer copy as an interim in-house fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
RT-Thread is an open-source real-time operating system (RTOS) widely used in embedded and IoT devices. The flaw resides in the CAN (Controller Area Network) message-handling library specific to the Loongson LS1C SoC BSP, in the recvmsg receive path defined in ls1c_can.h. The root cause is CWE-121 (Stack-based Buffer Overflow): the recvmsg routine writes attacker-influenced data into a fixed-size stack buffer without adequate bounds checking. On typical RTOS targets there is no MMU-backed process isolation or robust stack protection, so a stack overflow can directly overwrite return addresses and adjacent frame data, making memory corruption more impactful than on a full desktop OS. The CPE (cpe:2.3:a:n/a:rt-thread) confirms RT-Thread as the affected application, though it does not pin an exact version boundary beyond the 'up to 5.0.2' statement in the description.
Know when Rt Thread gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Local CAN interface access at low privilege with no user interaction (AV:L/PR:L/UI:N); stack overflow on an MMU-less RTOS yields full code-execution impact, so C:H/I:H/A:H.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability was identified in RT-Thread up to 5.0.2. Affected by this vulnerability is the function recvmsg in the library bsp/loongson/ls1cdev/libraries/ls1c_can.h of the component ls1c CAN Handler. Such manipulation leads to stack-based buffer overflow. Local access is required to approach this attack. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Executive ViewAI
RT-Thread RTOS versions through 5.0.2 contain a stack-based buffer overflow in the CAN handler enabling code execution on Loongson LS1C embedded systems; publicly available exploit code exists. Organizations running these embedded kernels in critical industrial or control applications face immediate threats to device integrity and operational availability. No vendor patch is available, requiring urgent implementation of compensating controls.
No vendor-released patch identified at time of analysis. Implement: (1) restrict local login access and disable non-essential user accounts on affected devices; (2) disable CAN handler functionality if not operationally required; (3) network isolation and segmentation to restrict lateral movement; (4) host-based monitoring for memory corruption exploitation signatures and abnormal process execution; (5) detailed audit logging of local authentication and process lifecycle events; (6) rapid isolation and containment procedures for any device exhibiting compromise indicators.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Critical memory corruption vulnerability in RT-Thread 5.1.0's sys_select syscall handler that allows authenticated local
Critical null pointer dereference vulnerability in RT-Thread 5.1.0's lwp_syscall.c csys_sendto function, allowing authen
Critical memory corruption vulnerability in RT-Thread 5.1.0's sys_recvfrom syscall handler that allows authenticated loc
A security vulnerability in A vulnerability classified as critical (CVSS 8.0). Risk factors: public PoC available.
Critical array index validation vulnerability in RT-Thread 5.1.0's signal mask syscall handler that allows authenticated
A vulnerability, which was classified as critical, was found in RT-Thread up to 5.1.0. This affects the function sys_dev
Stack-based buffer overflow in RT-Thread RTOS (versions up to and including 5.0.2) affects the CAN_Receive function with
A stack buffer overflow occurs in net/at/src/at_server.c in RT-Thread through 5.0.2. Rated critical severity (CVSS 9.8),
Memory corruption in RT-Thread's Linux-compatible process (lwp) syscall layer allows a local low-privileged user to cras
A vulnerability classified as problematic was found in RT-Thread up to 5.1.0. Rated medium severity (CVSS 4.8), this vul
A buffer overflow occurs in utilities/rt-link/src/rtlink.c in RT-Thread through 5.0.2. Rated high severity (CVSS 8.8), t
A stack buffer overflow occurs in libc/posix/ipc/mqueue.c in RT-Thread through 5.0.2. Rated high severity (CVSS 8.4), th
Exploit-DB