RT-Thread EUVD-2026-41674

Exploitation requires the attacker to hold at minimum low-privileged authenticated access to the target RT-Thread system (PR:L per CVSS 4.0 vector - unauthenticated exploitation is not supported by the available data). Critically, the lwp (lightweight process) component must be compiled into the RT-Thread firmware image; this component is not present in all builds and must be explicitly enabled, meaning the majority of minimal embedded deployments may not be affected. The target device must be reachable over a network (AV:N). Limiting factors include: authentication requirement (low privilege but not anonymous), non-default component dependency (lwp must be enabled), and the restricted deployment context of RT-Thread on embedded/IoT hardware that is often network-isolated. The impact is confined to availability (partial crash) with no confidentiality or integrity effect.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P) assigns a network-accessible, low-complexity attack requiring only low privileges, with impact limited to partial availability (VA:L) and no confidentiality or integrity consequences. The E:P (proof-of-concept) exploitability modifier is confirmed by the public GitHub issue. Despite the network attack vector, real-world risk is moderated by several factors: the lwp component must be explicitly enabled in the build, the attacker must hold at minimum low-privileged access to the target, and the impact is limited to a process/system crash rather than code execution or data exposure. RT-Thread's embedded/IoT deployment context means affected devices are often behind network boundaries, further reducing exposure. No EPSS data was provided in the input, and the absence of a CISA KEV entry suggests no confirmed widespread exploitation. The overall risk profile is moderate for environments where lwp-enabled RT-Thread devices are internet-facing or accessible to untrusted authenticated users.

An attacker with low-privileged access to a network-exposed RT-Thread device - for example, via a telnet or application-layer session - sends a crafted read, write, or ioctl syscall containing a parameter value of zero intended to function as a divisor within the lwp_syscall.c handler. The unvalidated parameter triggers a divide-by-zero fault, crashing the affected RTOS process or the entire system, causing denial of service. A public proof-of-concept demonstrating this technique is available via the GitHub issue at https://github.com/RT-Thread/rt-thread/issues/11429.