EUVD-2026-41674
GHSA-jp84-4rqr-29c5
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable with low-privilege authentication required; divide-by-zero yields availability impact only, no confidentiality or integrity effect, no scope change.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A flaw has been found in RT-Thread up to 5.2.2. Affected is the function read/write/sys_ioctl of the file components/lwp/lwp_syscall.c of the component Parameter Handler. Executing a manipulation can lead to divide by zero. The attack may be launched remotely. The exploit has been published and may be used. The pull request to fix this issue awaits acceptance.
AnalysisAI
Divide-by-zero in RT-Thread's lightweight process (lwp) syscall handler allows a low-privileged remote attacker to crash the RTOS by sending crafted read, write, or sys_ioctl system calls with malicious parameters to the affected handler in components/lwp/lwp_syscall.c. Affected versions are 5.2.2 and below. A public proof-of-concept exploit has been disclosed via GitHub issue #11429, though this vulnerability has not been added to the CISA KEV catalog, suggesting exploitation remains opportunistic rather than broadly weaponized. The upstream fix exists only as a pull request (PR #11453) awaiting merge acceptance.
Technical ContextAI
RT-Thread is an open-source, POSIX-compatible real-time operating system targeting embedded and IoT microcontroller platforms. The affected component, lwp (lightweight process), provides a POSIX-like syscall abstraction layer allowing user-space processes to invoke kernel services. The vulnerable functions - read, write, and sys_ioctl - reside in components/lwp/lwp_syscall.c and serve as the parameter handler for these calls. CWE-369 (Divide by Zero) indicates the root cause: the parameter handler fails to validate user-supplied input before using it as a divisor in an arithmetic operation, allowing an attacker to induce a division-by-zero fault. The CPE cpe:2.3:a:n/a:rt-thread:*:*:*:*:*:*:*:* covers all RT-Thread versions up to and including 5.2.2. Notably, the lwp component is not compiled into all RT-Thread builds by default - its presence is a prerequisite for exploitation.
RemediationAI
The upstream fix is available as pull request #11453 at https://github.com/RT-Thread/rt-thread/pull/11453, which awaits acceptance into the main branch - a released, officially tagged patched version has not been independently confirmed at time of analysis. Organizations should monitor the RT-Thread repository for merge and a tagged release. As a compensating control, disable or exclude the lwp (lightweight process) component from firmware builds if POSIX-like user-space syscall support is not required - this eliminates the vulnerable code path entirely and is the most reliable mitigation given the unmerged patch status. If lwp must remain enabled, restrict network access to RT-Thread devices to trusted networks or authenticated segments, and enforce the principle of least privilege on accounts that can issue syscalls. Note that disabling lwp may break applications relying on POSIX process semantics. Additional context is available at https://vuldb.com/vuln/376145 and the project repository at https://github.com/RT-Thread/rt-thread/.
Critical memory corruption vulnerability in RT-Thread 5.1.0's sys_select syscall handler that allows authenticated local
Critical null pointer dereference vulnerability in RT-Thread 5.1.0's lwp_syscall.c csys_sendto function, allowing authen
Critical memory corruption vulnerability in RT-Thread 5.1.0's sys_recvfrom syscall handler that allows authenticated loc
A security vulnerability in A vulnerability classified as critical (CVSS 8.0). Risk factors: public PoC available.
Critical array index validation vulnerability in RT-Thread 5.1.0's signal mask syscall handler that allows authenticated
A vulnerability, which was classified as critical, was found in RT-Thread up to 5.1.0. This affects the function sys_dev
Stack-based buffer overflow in RT-Thread RTOS (versions up to and including 5.0.2) affects the CAN_Receive function with
Stack-based buffer overflow in RT-Thread RTOS (versions up to and including 5.0.2) affects the recvmsg function within t
A stack buffer overflow occurs in net/at/src/at_server.c in RT-Thread through 5.0.2. Rated critical severity (CVSS 9.8),
Memory corruption in RT-Thread's Linux-compatible process (lwp) syscall layer allows a local low-privileged user to cras
A vulnerability classified as problematic was found in RT-Thread up to 5.1.0. Rated medium severity (CVSS 4.8), this vul
A buffer overflow occurs in utilities/rt-link/src/rtlink.c in RT-Thread through 5.0.2. Rated high severity (CVSS 8.8), t
Same weakness CWE-369 – Divide By Zero
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today