CVE-2026-14605: RT-Thread Buffer Overflow Vulnerability

CVE-2026-14605 Overview

CVE-2026-14605 is a stack-based buffer overflow in the RT-Thread real-time operating system through version 5.0.2. The flaw resides in the recvmsg function within bsp/loongson/ls1cdev/libraries/ls1c_can.h, part of the ls1c CAN Handler component. An attacker with local access and low privileges can trigger memory corruption on the stack, leading to compromise of confidentiality, integrity, and availability. Public exploit code exists, increasing the likelihood of opportunistic use against exposed embedded systems. The RT-Thread maintainers were contacted before public disclosure but did not respond. This weakness maps to [CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer].

Critical Impact
A local attacker can overflow a stack buffer in the RT-Thread ls1c CAN driver to corrupt memory and potentially execute arbitrary code on affected Loongson LS1C-based embedded devices.

Affected Products

RT-Thread real-time operating system versions up to and including 5.0.2
bsp/loongson/ls1cdev/libraries/ls1c_can.h ls1c CAN Handler component
Loongson LS1C development board firmware built on RT-Thread

Discovery Timeline

2026-07-03 - CVE-2026-14605 published to the National Vulnerability Database (NVD)
2026-07-06 - Last updated in NVD database

Technical Details for CVE-2026-14605

Vulnerability Analysis

The vulnerability affects the recvmsg function in the ls1c CAN Handler driver shipped with RT-Thread. The function processes Controller Area Network (CAN) messages on the Loongson LS1C platform. Improper bounds checking during message reception allows attacker-controlled input to write past the end of a fixed-size stack buffer. Stack-based overflows in embedded RTOS drivers frequently overwrite saved return addresses or adjacent local variables, enabling control-flow hijacking. Because RT-Thread executes tasks in a flat memory model without process isolation, corruption in a driver context can compromise the entire firmware image.

Root Cause

The root cause is missing or insufficient length validation on data copied into a stack-allocated buffer inside recvmsg. When the size of the incoming CAN message exceeds the destination buffer, adjacent stack memory is overwritten. This condition is classified under [CWE-119].

Attack Vector

Exploitation requires local access with low privileges on a device running the vulnerable RT-Thread build. An attacker interacts with the CAN interface exposed through the ls1c driver and supplies crafted message data that triggers the overflow. No user interaction is required. Publicly available exploit code lowers the technical barrier for adversaries targeting Loongson-based embedded deployments.

No verified proof-of-concept code has been reproduced in this article. Technical details are referenced in GitHub Issue #11424 and the VulDB CVE-2026-14605 entry.

Detection Methods for CVE-2026-14605

Indicators of Compromise

Unexpected task crashes, hard faults, or reboots on Loongson LS1C devices running RT-Thread when CAN traffic is processed
Malformed or oversized CAN frames observed on the bus targeting the recvmsg handler
Firmware integrity mismatches on devices that use the ls1c_can.h driver

Detection Strategies

Perform static analysis of the RT-Thread source tree for calls into recvmsg in bsp/loongson/ls1cdev/libraries/ls1c_can.h without prior length checks
Enable stack canaries and fault handlers in RT-Thread builds to catch overflow attempts at runtime
Compare deployed firmware image hashes against known-good baselines to identify tampered builds

Monitoring Recommendations

Log and alert on repeated hard-fault or exception events reported by RT-Thread's kernel exception handler
Monitor CAN bus telemetry for anomalously large or malformed frames directed at affected nodes
Track upstream commits to the RT-Thread GitHub repository for a patch addressing issue #11424

How to Mitigate CVE-2026-14605

Immediate Actions Required

Inventory all firmware built on RT-Thread 5.0.2 or earlier that includes the ls1c CAN driver
Restrict local and physical access to affected Loongson LS1C devices until a fix is deployed
Segment CAN networks so that untrusted devices cannot deliver crafted messages to vulnerable nodes

Patch Information

No vendor patch has been published at the time of writing. The maintainers did not respond to the disclosure. Track the GitHub Issue #11424 and the main RT-Thread repository for a future fix. Organizations shipping RT-Thread-based products should consider applying a local source patch that validates the length of incoming CAN messages before copying them into the stack buffer inside recvmsg.

Workarounds

Disable the ls1c CAN driver in RT-Thread board support package (BSP) configuration where CAN functionality is not required
Add an input-length check in the local fork of ls1c_can.h to reject CAN messages larger than the destination buffer
Enforce hardware-level access controls on CAN interfaces and physical device ports to block untrusted local actors

bash

# Example: disable the ls1c CAN component in RT-Thread menuconfig
scons --menuconfig
# Navigate: Hardware Drivers Config -> On-chip Peripheral Drivers -> Enable CAN
# Set to [ ] (disabled) if CAN is not required, then rebuild firmware
scons -c && scons -j4