EUVD-2026-41563
GHSA-q2qc-v4ph-4mrq
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local CAN-path access with low privileges and no user interaction (AV:L/PR:L/UI:N); stack overflow enabling code execution gives high C/I/A on the single MCU system (S:U).
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
5DescriptionCVE.org
A security flaw has been discovered in RT-Thread up to 5.0.2. Affected by this issue is the function CAN_Receive in the library bsp/synwit/libraries/SWM341_CSL/CMSIS/DeviceSupport/SWM341.h of the component SWM341 CAN Handler. Performing a manipulation results in stack-based buffer overflow. The attack needs to be approached locally. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Stack-based buffer overflow in RT-Thread RTOS (versions up to and including 5.0.2) affects the CAN_Receive function within the Synwit SWM341 board support package's CAN handler, allowing a local low-privileged attacker to corrupt the stack and potentially achieve code execution or crash the device. The flaw carries a CVSS 4.0 base score of 7.1, and publicly available exploit code exists. The vendor was contacted but did not respond, and there is no public evidence of active exploitation.
Technical ContextAI
RT-Thread is a widely used open-source real-time operating system (RTOS) for embedded and IoT devices. The defect resides in bsp/synwit/libraries/SWM341_CSL/CMSIS/DeviceSupport/SWM341.h, part of the CMSIS device-support layer for the Synwit SWM341 microcontroller, specifically in the CAN_Receive routine that handles inbound Controller Area Network (CAN) bus frames. The root cause is CWE-121 (stack-based buffer overflow): the function writes attacker-influenced CAN message data into a fixed-size stack buffer without adequate bounds checking, so a manipulated frame or receive length can overrun the buffer and overwrite adjacent stack memory including saved registers and return addresses. On typical MCU targets without stack canaries, ASLR, or memory protection, such an overflow directly threatens control-flow integrity.
RemediationAI
No vendor-released patched version has been identified at time of analysis; the vendor was contacted early but did not respond, and the referenced GitHub issue (https://github.com/RT-Thread/rt-thread/issues/11425) documents the bug rather than a tagged fixed release, so a released patched version is not independently confirmed. Monitor the upstream repository (https://github.com/RT-Thread/rt-thread/) for a commit or release addressing CAN_Receive and rebuild firmware once available. As compensating controls, if you do not use the Synwit SWM341 CAN peripheral, disable or exclude the SWM341 CAN handler from the build to remove the vulnerable code path entirely; restrict physical and logical access to the CAN bus and the device's local interfaces so untrusted parties cannot inject frames (trade-off: may complicate legitimate diagnostics/tooling); and add application-layer validation of CAN frame length/DLC before it reaches the vulnerable buffer. Because CAN is a bus-level protocol, network segmentation of the CAN domain and gateway filtering reduce exposure but do not fix the underlying overflow.
Critical memory corruption vulnerability in RT-Thread 5.1.0's sys_select syscall handler that allows authenticated local
Critical null pointer dereference vulnerability in RT-Thread 5.1.0's lwp_syscall.c csys_sendto function, allowing authen
Critical memory corruption vulnerability in RT-Thread 5.1.0's sys_recvfrom syscall handler that allows authenticated loc
A security vulnerability in A vulnerability classified as critical (CVSS 8.0). Risk factors: public PoC available.
Critical array index validation vulnerability in RT-Thread 5.1.0's signal mask syscall handler that allows authenticated
A vulnerability, which was classified as critical, was found in RT-Thread up to 5.1.0. This affects the function sys_dev
Stack-based buffer overflow in RT-Thread RTOS (versions up to and including 5.0.2) affects the recvmsg function within t
A stack buffer overflow occurs in net/at/src/at_server.c in RT-Thread through 5.0.2. Rated critical severity (CVSS 9.8),
Memory corruption in RT-Thread's Linux-compatible process (lwp) syscall layer allows a local low-privileged user to cras
A vulnerability classified as problematic was found in RT-Thread up to 5.1.0. Rated medium severity (CVSS 4.8), this vul
A buffer overflow occurs in utilities/rt-link/src/rtlink.c in RT-Thread through 5.0.2. Rated high severity (CVSS 8.8), t
A stack buffer overflow occurs in libc/posix/ipc/mqueue.c in RT-Thread through 5.0.2. Rated high severity (CVSS 8.4), th
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today