Executive brief
RT-Thread is an open-source real-time operating system (RTOS) widely used in Internet of Things (IoT) devices. A security flaw in the software's CAN bus communication handler allows a local attacker to cause a system crash or potentially execute unauthorized code. This could lead to a complete loss of device availability or compromise of the data handled by the affected IoT device.
Technical details
A stack-based buffer overflow vulnerability (CWE-121) exists in RT-Thread up to version 5.0.2 within the SWM341 CAN Handler component. The flaw is located in the CAN_Receive function in the bsp/synwit/libraries/SWM341_CSL/CMSIS/DeviceSupport/SWM341.h header file. The root cause is the trust of raw Data Length Code (DLC) values from incoming CAN frames, which are used to write data into fixed-size receive buffers without adequate bounds checking. A local attacker can exploit this by providing manipulated CAN traffic to trigger the overflow. While the vendor was notified, no official patch has been confirmed at the time of disclosure, though public exploit details are available.
Affected products
- RT-Thread RT-Thread up to 5.0.2
Timeline
- 2026-07-03: advisory: NVD publication date
- 2026-07-03: disclosed: Public disclosure of the vulnerability and exploit details