CVE-2026-14606: RT-Thread Buffer Overflow Vulnerability

CVE-2026-14606 Overview

CVE-2026-14606 is a stack-based buffer overflow vulnerability in RT-Thread real-time operating system versions up to 5.0.2. The flaw resides in the CAN_Receive function within bsp/synwit/libraries/SWM341_CSL/CMSIS/DeviceSupport/SWM341.h, part of the SWM341 CAN Handler component. Attackers with local access can manipulate input to the function and trigger memory corruption on the stack. The exploit has been publicly released, increasing the risk of active abuse against embedded and IoT devices running RT-Thread. The RT-Thread project was contacted about the disclosure but did not respond, and no vendor patch has been confirmed at publication time.

Critical Impact
Local attackers can corrupt the stack of the CAN handler in RT-Thread ≤ 5.0.2, enabling code execution or denial of service on embedded devices running the affected SWM341 driver.

Affected Products

RT-Thread real-time operating system versions up to and including 5.0.2
SWM341 CAN Handler component (bsp/synwit/libraries/SWM341_CSL/CMSIS/DeviceSupport/SWM341.h)
Embedded and IoT devices integrating the affected SWM341 board support package

Discovery Timeline

2026-07-03 - CVE-2026-14606 published to the National Vulnerability Database
2026-07-06 - Entry last updated in NVD

Technical Details for CVE-2026-14606

Vulnerability Analysis

The vulnerability is a stack-based buffer overflow [CWE-119] in the CAN_Receive function of the SWM341 Controller Area Network (CAN) handler shipped with RT-Thread. The function processes incoming CAN frame data and writes it into a fixed-size buffer allocated on the stack. When the size of the received or supplied data exceeds the destination buffer, adjacent stack memory including saved return addresses is overwritten.

RT-Thread is a real-time operating system used across microcontrollers and embedded systems. The affected code path runs at driver level, which typically executes with elevated privileges relative to application tasks. Successful exploitation can yield arbitrary code execution within the firmware context or cause the device to crash.

Root Cause

The root cause is the absence of bounds checking on data copied by CAN_Receive into a stack-allocated buffer. The function trusts the length of incoming CAN payload metadata without validating it against the destination buffer size, violating safe memory-handling practices for driver code.

Attack Vector

Exploitation requires local access with low privileges and no user interaction. An attacker with the ability to submit crafted input to the CAN receive path, either through an interfaced peripheral, an on-device task, or a physical CAN bus connection on affected hardware, can drive CAN_Receive to overflow its stack buffer. A public proof of concept has been released, lowering the barrier for weaponization.

No verified exploit code is included here. Refer to the GitHub Issue #11425 and VulDB entry for CVE-2026-14606 for technical details.

Detection Methods for CVE-2026-14606

Indicators of Compromise

Unexpected resets, hard faults, or watchdog-triggered reboots on devices running RT-Thread with the SWM341 CAN driver.
Abnormal CAN bus traffic patterns, including malformed frames or frames with oversized payload metadata targeting the affected handler.
Firmware task crashes or corrupted call stacks visible in on-device logging or JTAG traces near CAN_Receive.

Detection Strategies

Perform source-level review of bsp/synwit/libraries/SWM341_CSL/CMSIS/DeviceSupport/SWM341.h to identify use of CAN_Receive without validated length checks.
Run fuzzing against the CAN receive path in test harnesses to reproduce the overflow before deployment.
Enable compiler-based stack protections such as stack canaries where the toolchain and target support them, and monitor for canary violations.

Monitoring Recommendations

Aggregate device telemetry, crash dumps, and CAN interface logs into a centralized log platform for correlation across fleets.
Alert on repeated abnormal resets or CAN driver faults from the same device or bus segment.
Track any process or firmware update activity on embedded assets that deviates from approved baselines.

How to Mitigate CVE-2026-14606

Immediate Actions Required

Inventory all devices and firmware images built on RT-Thread ≤ 5.0.2 that include the SWM341 board support package.
Restrict physical and logical access to CAN interfaces on affected devices to trusted operators only.
Disable or remove the SWM341 CAN driver in firmware builds where the CAN peripheral is not required.

Patch Information

As of the last NVD update on 2026-07-06, no vendor patch has been published. The reporter states that RT-Thread maintainers did not respond to the disclosure. Track the RT-Thread GitHub repository and Issue #11425 for upstream fixes, and rebuild affected firmware once corrections are merged.

Workarounds

Apply a local source patch to CAN_Receive that validates incoming payload length against the destination buffer before copying.
Enforce network segmentation on CAN buses so that only authenticated nodes can transmit frames to affected controllers.
Enable available memory protection features such as MPU regions, stack canaries, and non-executable stacks in the RT-Thread build configuration.

bash

# Configuration example
# Review usage of CAN_Receive across the RT-Thread source tree
grep -rn "CAN_Receive" bsp/synwit/libraries/SWM341_CSL/

# Rebuild firmware with stack protection where supported by the toolchain
scons --menuconfig
# Enable: RT_USING_MPU, stack overflow checking, and compiler flag -fstack-protector-strong
scons -j4