Is CVE-2026-14629 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-14629 being exploited in the wild.

How severe is CVE-2026-14629?

Medium severity, with a CVSS score of 4.3, published 4 July 2026.

Is there a fix for CVE-2026-14629?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-14629 attacked?

It is attacked over the network, in an operating system.

Am I affected by CVE-2026-14629?

Check whether you run RT-Thread at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-14629: RT-Thread RTOS denial of service in serial device ioctl handler

CVE-2026-14629 · Severity: medium · CVSS 4.3 · Published 2026-07-04

RT-Thread is an open-source real-time operating system (RTOS) widely used in Internet of Things (IoT) devices. A security flaw in how the system handles communication with serial devices (like sensors or diagnostic ports) allows a user to crash the entire operating system. This could lead to a complete service outage for the affected device, requiring a manual restart to restore operations.

Technologies: RT-Thread. Vendors: RT-Thread.

Quick answers

Is CVE-2026-14629 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-14629 being exploited in the wild.
How severe is CVE-2026-14629?: Medium severity, with a CVSS score of 4.3, published 4 July 2026.
Which products and versions are affected?: RT-Thread up to 5.2.2.
Is there a fix for CVE-2026-14629?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-14629 attacked?: It is attacked over the network, in an operating system.
Am I affected by CVE-2026-14629?: Check whether you run RT-Thread at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in the RT-Smart LWP (Lightweight Process) syscall layer of RT-Thread up to 5.2.2. The `sys_ioctl` function in `components/lwp/lwp_syscall.c` fails to validate or copy user-space pointers before passing them to the kernel-side `rt_device_control`. When targeting serial devices, an attacker can provide an invalid pointer, leading to a kernel crash during dereference in `rt_serial_control`. Additionally, by providing a valid pointer to a structure with a `baud_rate` of zero, an attacker can trigger a divide-by-zero error in board-specific UART drivers (such as the imx6ull-smart BSP). A pull request (#11453) has been submitted to harden pointer handling and validate configuration parameters.

Affected products

RT-Thread RT-Thread up to 5.2.2

Timeline

2026-06-09: disclosed: Issue reported on GitHub and fix proposed via pull request
2026-07-04: advisory: CVE published by VulDB

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.