RT-Thread CVE-2026-14606

Exploitation requires local access to the target device and the ability to feed data through the Synwit SWM341 CAN receive path - i.e., the firmware must be built with the SWM341 BSP and actively using the SWM341 CAN handler / CAN_Receive function, and the attacker must be able to inject or manipulate CAN frames reaching that handler. Per the CVSS vector (AV:L, PR:L), it is not remotely exploitable and needs low-level privileges/local proximity rather than a network path; no user interaction is required (UI:N). Limiting factors: only RT-Thread builds targeting the Synwit SWM341 microcontroller with CAN enabled are affected, and the attacker must reach the CAN bus/interface, so devices not using this specific BSP or CAN peripheral are not exposed.

The vendor-supplied CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) describes a local, low-complexity attack requiring low privileges but no user interaction, with high impact to confidentiality, integrity, and availability of the vulnerable system - hence the 7.1 score. The local attack vector is the dominant limiting factor: an attacker needs local access to the CAN interface or the ability to inject frames onto the bus, so this is not remotely exploitable over a network and does not lend itself to mass, automatable exploitation. Publicly available exploit code raises the practical risk for targeted scenarios, but this is not listed in CISA KEV and no EPSS score was provided, so there is no evidence of widespread active exploitation - the signals point to a real but access-gated, likely-targeted issue rather than an internet-scale emergency. The affected code path is a niche vendor BSP (Synwit SWM341), further narrowing real-world exposure.

An attacker with local access to the device or its CAN bus crafts a malformed CAN frame (or manipulates the received length/data) that is processed by CAN_Receive, overrunning the fixed-size stack buffer. Given CVSS AV:L/AC:L, the attack is low-complexity but requires local proximity to the interface; the overflow overwrites the stack to crash the RTOS task or hijack control flow. Public exploit code is already available, lowering the barrier for a capable local attacker to reproduce the condition.