# CVE-2026-14606: RT-Thread SWM341 CAN Handler stack buffer overflow in CAN_Receive

Source: https://junglewise.ai/threats/cve-2026-14606-rt-thread-swm341-can-handler-stack-buffer-overflow-in-can-receive  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-03. Updated: 2026-07-03  
License: CC BY 4.0 with a link back

CVE-2026-14606 · Severity: high · CVSS 7.8 · Published 2026-07-03

RT-Thread is an open-source real-time operating system (RTOS) widely used in Internet of Things (IoT) devices. A security flaw in the software's CAN bus communication handler allows a local attacker to cause a system crash or potentially execute unauthorized code. This could lead to a complete loss of device availability or compromise of the data handled by the affected IoT device.

Technologies: [RT-Thread](https://junglewise.ai/threats/technologies/rt-thread). Vendors: [RT-Thread](https://junglewise.ai/threats/vendors/rt-thread).

## Quick answers

**Is CVE-2026-14606 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-14606 being exploited in the wild.

**How severe is CVE-2026-14606?** High severity, with a CVSS score of 7.8, published 3 July 2026.

**Which products and versions are affected?** RT-Thread up to 5.0.2.

**Is there a fix for CVE-2026-14606?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-14606 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-14606?** Check whether you run RT-Thread at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stack-based buffer overflow vulnerability (CWE-121) exists in RT-Thread up to version 5.0.2 within the SWM341 CAN Handler component. The flaw is located in the CAN_Receive function in the bsp/synwit/libraries/SWM341_CSL/CMSIS/DeviceSupport/SWM341.h header file. The root cause is the trust of raw Data Length Code (DLC) values from incoming CAN frames, which are used to write data into fixed-size receive buffers without adequate bounds checking. A local attacker can exploit this by providing manipulated CAN traffic to trigger the overflow. While the vendor was notified, no official patch has been confirmed at the time of disclosure, though public exploit details are available.

## Affected products

- RT-Thread RT-Thread up to 5.0.2

## Timeline

- 2026-07-03: advisory: NVD publication date
- 2026-07-03: disclosed: Public disclosure of the vulnerability and exploit details

## References

- [https://github.com/RT-Thread/rt-thread/](https://github.com/RT-Thread/rt-thread/)
- [https://github.com/RT-Thread/rt-thread/issues/11425](https://github.com/RT-Thread/rt-thread/issues/11425)
- [https://vuldb.com/cve/CVE-2026-14606](https://vuldb.com/cve/CVE-2026-14606)
- [https://vuldb.com/submit/844591](https://vuldb.com/submit/844591)
- [https://vuldb.com/vuln/376114](https://vuldb.com/vuln/376114)
- [https://vuldb.com/vuln/376114/cti](https://vuldb.com/vuln/376114/cti)

## Related threats

- [RT-Thread USB CDC memory corruption in ring buffer](https://junglewise.ai/threats/cve-2026-108952-rt-thread-through-5-3-0-contains-a-memory-corruption)
- [RT-Thread RTOS denial of service in serial device ioctl handler](https://junglewise.ai/threats/cve-2026-14629-rt-thread-rtos-denial-of-service-in-serial-device-ioctl-handler)
- [RT-Thread memory corruption in sys_getaddrinfo syscall](https://junglewise.ai/threats/cve-2026-14607-rt-thread-memory-corruption-in-sys-getaddrinfo-syscall)
- [RT-Thread stack overflow in ls1c CAN Handler recvmsg](https://junglewise.ai/threats/cve-2026-14605-rt-thread-stack-overflow-in-ls1c-can-handler-recvmsg)