EUVD-2026-41562
GHSA-whcm-77gq-7fj3
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local CAN interface access at low privilege with no user interaction (AV:L/PR:L/UI:N); stack overflow on an MMU-less RTOS yields full code-execution impact, so C:H/I:H/A:H.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability was identified in RT-Thread up to 5.0.2. Affected by this vulnerability is the function recvmsg in the library bsp/loongson/ls1cdev/libraries/ls1c_can.h of the component ls1c CAN Handler. Such manipulation leads to stack-based buffer overflow. Local access is required to approach this attack. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Stack-based buffer overflow in RT-Thread RTOS (versions up to and including 5.0.2) affects the recvmsg function within the ls1c CAN handler (bsp/loongson/ls1cdev/libraries/ls1c_can.h) for the Loongson LS1C board support package. A local attacker with low privileges can manipulate the recvmsg call path to overflow a stack buffer, corrupting memory to achieve code execution or crash the device. Publicly available exploit code exists (VulDB), but there is no public exploit identified as actively used in the wild; this is not on CISA KEV, and no vendor patch has been identified as the vendor did not respond to disclosure.
Technical ContextAI
RT-Thread is an open-source real-time operating system (RTOS) widely used in embedded and IoT devices. The flaw resides in the CAN (Controller Area Network) message-handling library specific to the Loongson LS1C SoC BSP, in the recvmsg receive path defined in ls1c_can.h. The root cause is CWE-121 (Stack-based Buffer Overflow): the recvmsg routine writes attacker-influenced data into a fixed-size stack buffer without adequate bounds checking. On typical RTOS targets there is no MMU-backed process isolation or robust stack protection, so a stack overflow can directly overwrite return addresses and adjacent frame data, making memory corruption more impactful than on a full desktop OS. The CPE (cpe:2.3:a:n/a:rt-thread) confirms RT-Thread as the affected application, though it does not pin an exact version boundary beyond the 'up to 5.0.2' statement in the description.
RemediationAI
No vendor-released patch identified at time of analysis - the vendor was contacted but did not respond, so no fixed version number can be cited. Track the upstream issue at https://github.com/RT-Thread/rt-thread/issues/11424 and the repository https://github.com/RT-Thread/rt-thread/ for a corrective commit or release. As specific compensating controls: on devices that do not require the Loongson LS1C CAN driver, exclude or disable the ls1c_can component from the build to remove the vulnerable recvmsg path entirely (trade-off: loss of CAN functionality on those boards); restrict which local processes/tasks can access the CAN socket interface so untrusted code cannot invoke recvmsg with crafted input (trade-off: requires privilege partitioning that many RTOS firmware images lack); and for physically exposed devices, control access to the CAN bus and enforce input validation/length checks on inbound CAN messages before they reach the driver. Where source access is available, add bounds checking to the recvmsg buffer copy as an interim in-house fix.
Critical memory corruption vulnerability in RT-Thread 5.1.0's sys_select syscall handler that allows authenticated local
Critical null pointer dereference vulnerability in RT-Thread 5.1.0's lwp_syscall.c csys_sendto function, allowing authen
Critical memory corruption vulnerability in RT-Thread 5.1.0's sys_recvfrom syscall handler that allows authenticated loc
A security vulnerability in A vulnerability classified as critical (CVSS 8.0). Risk factors: public PoC available.
Critical array index validation vulnerability in RT-Thread 5.1.0's signal mask syscall handler that allows authenticated
A vulnerability, which was classified as critical, was found in RT-Thread up to 5.1.0. This affects the function sys_dev
Stack-based buffer overflow in RT-Thread RTOS (versions up to and including 5.0.2) affects the CAN_Receive function with
A stack buffer overflow occurs in net/at/src/at_server.c in RT-Thread through 5.0.2. Rated critical severity (CVSS 9.8),
Memory corruption in RT-Thread's Linux-compatible process (lwp) syscall layer allows a local low-privileged user to cras
A vulnerability classified as problematic was found in RT-Thread up to 5.1.0. Rated medium severity (CVSS 4.8), this vul
A buffer overflow occurs in utilities/rt-link/src/rtlink.c in RT-Thread through 5.0.2. Rated high severity (CVSS 8.8), t
A stack buffer overflow occurs in libc/posix/ipc/mqueue.c in RT-Thread through 5.0.2. Rated high severity (CVSS 8.4), th
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today