CVE-2026-14607: RT-Thread Buffer Overflow Vulnerability

CVE-2026-14607 Overview

CVE-2026-14607 is a memory corruption vulnerability in RT-Thread real-time operating system versions up to 5.0.2. The flaw resides in the sys_getaddrinfo function within components/lwp/lwp_syscall.c. Manipulating the ai_addr argument triggers memory corruption during the syscall handling path. Exploitation requires local access with low-privilege user context on an affected RT-Thread device. A public exploit has been disclosed, and the upstream pull request that addresses the issue is still awaiting acceptance at the time of publication. The weakness is classified under [CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer].

Critical Impact
Local attackers can corrupt memory in the RT-Thread kernel syscall handler, enabling denial of service and potentially further compromise of embedded devices running vulnerable firmware.

Affected Products

RT-Thread RTOS versions up to and including 5.0.2
Firmware images built with the vulnerable lwp_syscall.c component
Embedded and IoT devices using the RT-Thread sys_getaddrinfo syscall implementation

Discovery Timeline

2026-07-03 - CVE-2026-14607 published to NVD
2026-07-06 - Last updated in NVD database

Technical Details for CVE-2026-14607

Vulnerability Analysis

The vulnerability affects the syscall bridge that RT-Thread exposes to user-land Lightweight Process (LWP) applications. The sys_getaddrinfo function accepts pointers from user space, including the ai_addr field embedded in the addrinfo structure. Insufficient validation of that pointer and the associated length allows a local caller to induce memory corruption inside the kernel address space.

Because the flaw sits in a syscall handler, corruption occurs in a privileged execution context. Impact ranges from immediate task crashes to potential attacker-controlled writes depending on how downstream code consumes the manipulated ai_addr value. Availability is the primary demonstrated impact per the disclosure.

Root Cause

The root cause is improper restriction of operations within memory buffer bounds during handling of user-supplied addrinfo structures. The sys_getaddrinfo routine trusts the ai_addr pointer or its length field without adequate sanity checks before copying or dereferencing memory on behalf of the caller.

Attack Vector

Exploitation requires local code execution on the device, such as a compromised or malicious user-mode process, and low privileges. An attacker crafts a malformed addrinfo structure and invokes sys_getaddrinfo, passing a manipulated ai_addr argument. The syscall then performs an out-of-bounds memory operation inside the kernel, corrupting adjacent state.

The vulnerability manifests inside components/lwp/lwp_syscall.c. Refer to the upstream tracker for reproduction specifics: GitHub Issue #11428 and the proposed fix in GitHub Pull Request #11454.

Detection Methods for CVE-2026-14607

Indicators of Compromise

Unexpected task or kernel crashes correlated with calls to getaddrinfo from LWP user-mode applications.
Unexplained reboots or watchdog resets on RT-Thread devices following execution of untrusted binaries.
Presence of unauthorized user-mode processes issuing network resolution syscalls with malformed addrinfo structures.

Detection Strategies

Audit firmware builds to confirm whether they include components/lwp/lwp_syscall.c from RT-Thread 5.0.2 or earlier.
Instrument the sys_getaddrinfo code path in development builds to log unusually large or misaligned ai_addr values.
Compare deployed RT-Thread commit hashes against the merge state of GitHub Pull Request #11454 to identify unpatched devices.

Monitoring Recommendations

Collect crash dumps and serial console logs from RT-Thread devices for offline analysis of syscall-related faults.
Monitor deployment pipelines for RT-Thread SDK versions and block builds that pin to vulnerable releases.
Track the VulDB entry for CVE-2026-14607 for updates on public exploit activity.

How to Mitigate CVE-2026-14607

Immediate Actions Required

Inventory all firmware and products that embed RT-Thread and identify those built from versions 5.0.2 or earlier.
Restrict the ability to load or execute untrusted user-mode LWP applications on affected devices.
Rebuild firmware from a patched RT-Thread tree once the upstream fix is merged, and stage an update rollout.

Patch Information

No official released patch is available at the time of publication. A fix has been proposed upstream in GitHub Pull Request #11454 and is awaiting acceptance. Vendors shipping RT-Thread should track the RT-Thread repository and integrate the fix once merged, then reissue firmware for affected products.

Workarounds

Disable or remove the LWP subsystem from firmware builds when user-mode processes are not required for the product.
Apply the proposed patch from Pull Request #11454 as a local backport after independent review and testing.
Enforce secure boot and code signing to prevent unauthorized local binaries from invoking sys_getaddrinfo on production devices.

bash

# Identify RT-Thread version and LWP syscall presence in a source tree
grep -R "#define RT_VERSION" ./rt-thread/include
grep -n "sys_getaddrinfo" ./rt-thread/components/lwp/lwp_syscall.c