EUVD-2026-41564
GHSA-g6q3-rr42-f5h7
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local-only vector (AV:L) with low privilege required (PR:L); memory corruption causes kernel crash so A:H; no confidentiality or integrity impact indicated by description or CVSS 4.0 source data.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A weakness has been identified in RT-Thread up to 5.0.2. This affects the function sys_getaddrinfo of the file components/lwp/lwp_syscall.c. Executing a manipulation of the argument ai_addr can lead to memory corruption. The attack can only be executed locally. The exploit has been made available to the public and could be used for attacks. The pull request to fix this issue awaits acceptance.
AnalysisAI
Memory corruption in RT-Thread's Linux-compatible process (lwp) syscall layer allows a local low-privileged user to crash the RTOS kernel by supplying a crafted ai_addr argument to the sys_getaddrinfo handler in components/lwp/lwp_syscall.c. All RT-Thread versions through 5.0.2 are affected, with impact limited to availability (VA:H) - no confidentiality or integrity loss is indicated. A public proof-of-concept exists (GitHub issue #11428), though exploitation is not confirmed in CISA KEV; the upstream fix remains an unmerged pull request, leaving all deployed versions currently unpatched.
Technical ContextAI
RT-Thread is an open-source real-time operating system targeting embedded and IoT devices. Its Linux-compatible process (lwp) subsystem (components/lwp/) provides POSIX-style syscalls to user-space processes, including sys_getaddrinfo, which wraps DNS resolution and address translation analogous to the standard getaddrinfo() API. The vulnerability is rooted in CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) - specifically a buffer overflow triggered when the ai_addr sockaddr-family argument is not properly validated before memory operations, permitting out-of-bounds writes in kernel space. The CPE cpe:2.3:a:n/a:rt-thread:*:*:*:*:*:*:*:* covers the full version range through 5.0.2. The lwp subsystem is an optional component that must be compiled in; minimal RT-Thread builds without lwp are not affected by this code path.
RemediationAI
No officially released patched version is available at time of analysis. The upstream fix exists as an open pull request (https://github.com/RT-Thread/rt-thread/pull/11454) that has not yet been merged into the RT-Thread codebase. Operators should monitor the RT-Thread repository and VulDB advisory (https://vuldb.com/vuln/376115) for merge and release notifications, then upgrade immediately upon availability. As a compensating control, restrict local shell or application execution access on RT-Thread devices to fully trusted principals, since exploitation requires local code execution with at least low privilege. Where operationally feasible, building RT-Thread without the lwp subsystem (components/lwp) eliminates this specific attack surface entirely, though this trades away POSIX process compatibility. Applying the patch from PR #11454 manually to local source trees is possible but carries the risk of an unreviewed, unmerged change; teams should weigh this against continued exposure.
Critical memory corruption vulnerability in RT-Thread 5.1.0's sys_select syscall handler that allows authenticated local
Critical null pointer dereference vulnerability in RT-Thread 5.1.0's lwp_syscall.c csys_sendto function, allowing authen
Critical memory corruption vulnerability in RT-Thread 5.1.0's sys_recvfrom syscall handler that allows authenticated loc
A security vulnerability in A vulnerability classified as critical (CVSS 8.0). Risk factors: public PoC available.
Critical array index validation vulnerability in RT-Thread 5.1.0's signal mask syscall handler that allows authenticated
A vulnerability, which was classified as critical, was found in RT-Thread up to 5.1.0. This affects the function sys_dev
Stack-based buffer overflow in RT-Thread RTOS (versions up to and including 5.0.2) affects the CAN_Receive function with
Stack-based buffer overflow in RT-Thread RTOS (versions up to and including 5.0.2) affects the recvmsg function within t
A stack buffer overflow occurs in net/at/src/at_server.c in RT-Thread through 5.0.2. Rated critical severity (CVSS 9.8),
A vulnerability classified as problematic was found in RT-Thread up to 5.1.0. Rated medium severity (CVSS 4.8), this vul
A buffer overflow occurs in utilities/rt-link/src/rtlink.c in RT-Thread through 5.0.2. Rated high severity (CVSS 8.8), t
A stack buffer overflow occurs in libc/posix/ipc/mqueue.c in RT-Thread through 5.0.2. Rated high severity (CVSS 8.4), th
Same weakness CWE-119 – Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today