Executive brief
A security vulnerability has been identified in RT-Thread, an open-source operating system used for Internet of Things (IoT) devices. The flaw exists in the component that handles Controller Area Network (CAN) communications, which are commonly used in automotive and industrial systems. If exploited, a local attacker could cause a system crash or potentially gain unauthorized control over the device, impacting the reliability and security of the connected hardware.
Technical details
A stack-based buffer overflow vulnerability exists in RT-Thread up to version 5.0.2 within the 'recvmsg' function of the ls1c CAN Handler (specifically in bsp/loongson/ls1cdev/libraries/ls1c_can.h). The root cause is the improper validation of the Data Length Code (DLC) from incoming CAN messages; the system trusts the raw DLC value and writes data beyond the bounds of the 'rt_can_msg' structure. This is a local attack requiring low privileges, as the attacker must be able to interact with the CAN interface. Successful exploitation can lead to a complete compromise of confidentiality, integrity, and availability. As of the advisory date, the vendor has not responded to the disclosure.
Affected products
- RT-Thread RT-Thread up to 5.0.2
Timeline
- 2026-07-03: advisory: NVD publication date
- 2026-07-03: disclosed: Public disclosure of the vulnerability and exploit availability