RT-Thread CVE-2026-14607

Exploitation requires the target device to be running RT-Thread version 5.0.2 or earlier with the lwp (Linux-compatible process) subsystem compiled and active - this is not enabled in all RT-Thread configurations and represents a specific build-time choice. The attacker must have local code execution with at least low-privilege access (PR:L per CVSS 4.0) sufficient to invoke the sys_getaddrinfo syscall; no network access path exists (AV:L). No user interaction or elevated (root/admin) privileges are required beyond local execution rights. Exploitation is limited by the local-only attack vector, the requirement for the lwp subsystem to be present, and the fact that impact is confined to availability (device crash/DoS) - data exfiltration or code execution beyond the crash are not indicated by available data.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N) with E:P supplemental metric accurately characterizes the threat: local-only access, low complexity, low privilege, no interaction, and exclusively availability impact. The local attack vector substantially limits the blast radius compared to a network-exploitable flaw - an attacker must already have code execution on the target device. In RT-Thread's typical deployment contexts (embedded controllers, IoT gateways, industrial devices), local access may be achievable through a compromised co-resident application or physical access, making this non-trivial to dismiss. The absence of a CISA KEV listing means active exploitation is not confirmed, and no EPSS data was provided. The open but unmerged PR (#11454) is a meaningful risk amplifier: the exposure window extends until the PR is merged and a release is cut, with no vendor-issued patch currently available. Real-world priority should be moderate - embedded availability is operationally critical, but the local-only vector and lack of C/I impact constrain urgency compared to remote or authenticated-bypass flaws.

A low-privileged application or user process running on an RT-Thread 5.0.2 device with lwp enabled calls getaddrinfo() with a specially crafted ai_addr pointer argument, which the kernel-side sys_getaddrinfo handler writes to without adequate bounds validation. The resulting out-of-bounds memory corruption in kernel space causes the RT-Thread kernel to crash, taking down all processes and services on the device. A public proof-of-concept is available at https://github.com/RT-Thread/rt-thread/issues/11428, reducing the skill bar needed for exploitation.