# CVE-2026-14607: RT-Thread memory corruption in sys_getaddrinfo syscall

Source: https://junglewise.ai/threats/cve-2026-14607-rt-thread-memory-corruption-in-sys-getaddrinfo-syscall  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-03. Updated: 2026-07-03  
License: CC BY 4.0 with a link back

CVE-2026-14607 · Severity: medium · CVSS 5.5 · Published 2026-07-03

RT-Thread is an open-source real-time operating system used in Internet of Things (IoT) devices. A security flaw in how the system handles network address lookups could allow a local attacker to cause memory corruption. This could lead to a system crash or instability, potentially disrupting the operations of the affected IoT device.

Technologies: [RT-Thread](https://junglewise.ai/threats/technologies/rt-thread). Vendors: [RT-Thread](https://junglewise.ai/threats/vendors/rt-thread).

## Quick answers

**Is CVE-2026-14607 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-14607 being exploited in the wild.

**How severe is CVE-2026-14607?** Medium severity, with a CVSS score of 5.5, published 3 July 2026.

**Which products and versions are affected?** RT-Thread up to 5.0.2.

**Is there a fix for CVE-2026-14607?** A patch was published on 2026-06-09: Pull request to fix the issue submitted on GitHub Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-14607 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-14607?** Check whether you run RT-Thread at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A memory corruption vulnerability (CWE-119) exists in RT-Thread up to version 5.0.2 within the 'sys_getaddrinfo' system call located in 'components/lwp/lwp_syscall.c'. The issue stems from the kernel trusting a nested user-provided pointer ('ai_addr') without adequate validation. In builds using the Memory Management Unit (MMU), the kernel dereferences this nested pointer and performs writes in kernel context, allowing a local process to redirect kernel writes to memory locations outside of the validated user space. An attacker with local access can exploit this to cause memory corruption and system instability. A pull request (#11454) has been submitted to harden pointer handling by copying user inputs to kernel temporaries and validating nested destinations before writeback.

## Affected products

- RT-Thread RT-Thread up to 5.0.2

## Timeline

- 2026-06-09: patched: Pull request to fix the issue submitted on GitHub
- 2026-07-03: advisory: NVD and VulDB published the vulnerability details

## References

- [https://github.com/RT-Thread/rt-thread/](https://github.com/RT-Thread/rt-thread/)
- [https://github.com/RT-Thread/rt-thread/issues/11428](https://github.com/RT-Thread/rt-thread/issues/11428)
- [https://github.com/RT-Thread/rt-thread/pull/11454](https://github.com/RT-Thread/rt-thread/pull/11454)
- [https://vuldb.com/cve/CVE-2026-14607](https://vuldb.com/cve/CVE-2026-14607)
- [https://vuldb.com/submit/844622](https://vuldb.com/submit/844622)
- [https://vuldb.com/vuln/376115](https://vuldb.com/vuln/376115)
- [https://vuldb.com/vuln/376115/cti](https://vuldb.com/vuln/376115/cti)

## Related threats

- [RT-Thread USB CDC memory corruption in ring buffer](https://junglewise.ai/threats/cve-2026-108952-rt-thread-through-5-3-0-contains-a-memory-corruption)
- [RT-Thread RTOS denial of service in serial device ioctl handler](https://junglewise.ai/threats/cve-2026-14629-rt-thread-rtos-denial-of-service-in-serial-device-ioctl-handler)
- [RT-Thread SWM341 CAN Handler stack buffer overflow in CAN_Receive](https://junglewise.ai/threats/cve-2026-14606-rt-thread-swm341-can-handler-stack-buffer-overflow-in-can-receive)
- [RT-Thread stack overflow in ls1c CAN Handler recvmsg](https://junglewise.ai/threats/cve-2026-14605-rt-thread-stack-overflow-in-ls1c-can-handler-recvmsg)