CVE-2026-14605: RT-Thread Stack Buffer Overflow in LS1C CAN Handler

Technical summary

The vulnerability is a classic stack-based buffer overflow (CWE-119, CWE-121) in the recvmsg function of the Loongson LS1C CAN handler library. The recvmsg function fails to properly validate or bound the size of data being written to a stack buffer, allowing a local attacker to write more data than the buffer can hold. This overflow corrupts the call stack, potentially overwriting function return addresses or saved registers. With careful payload construction, an attacker can redirect execution to arbitrary code or escalate privileges. The attack vector is local (AV:L), requires low privileges (PR:L), and needs no user interaction (UI:N), resulting in a CVSS 3.1 score of 7.8 (HIGH). The vulnerability affects confidentiality, integrity, and availability equally.

Business impact

RT-Thread is commonly deployed in embedded systems, IoT devices, and industrial control applications, particularly in devices using Loongson processors. A compromise via this vulnerability could lead to unauthorized access to sensitive device functions, tampering with device behavior or data, denial of service, or lateral movement within a connected industrial or IoT network. Organizations relying on RT-Thread in production environments face risks to system availability and data integrity. The impact is amplified in scenarios where compromised devices control critical processes or communicate with trusted infrastructure.

Affected systems

RT-Thread versions up to and including 5.0.2 are affected when deployed on Loongson LS1C-based systems using the ls1c CAN handler. The specific component impacted is the CAN communication library (bsp/loongson/ls1cdev/libraries/ls1c_can.h). Systems using RT-Thread on other processor architectures or those not utilizing the LS1C CAN handler are not affected by this specific vulnerability. Users should verify their RT-Thread deployment against the exact version and component configuration.

Exploitability

Public exploit code is available, reducing the barrier to weaponization. The vulnerability requires local system access—an attacker must already have user-level credentials or physical access to the device. In many embedded deployments, this prerequisite may be realistic due to shared administrative access, maintenance interfaces, or physical proximity to devices. The low complexity (AC:L) and straightforward nature of stack-based buffer overflows make this vulnerability practical to exploit once access is gained. The presence of public exploits elevates urgency for patching.

Remediation

Upgrade RT-Thread to a version newer than 5.0.2 that incorporates a fix for the buffer overflow. Verify the specific patch version against the official RT-Thread advisory or release notes. Interim mitigations include restricting local system access via principle of least privilege, disabling or isolating CAN handler functionality if not required, and monitoring for abnormal CAN message traffic or stack corruption events. For devices in production that cannot be patched immediately, implement network segmentation and access controls to limit which users or processes can invoke the vulnerable recvmsg function.

Patch guidance

Check the RT-Thread official repository and security advisories for versions released after 5.0.2. Patch testing should focus on CAN communication functionality to ensure no regression. For embedded deployments, coordinate patching with device firmware release cycles and conduct regression testing on representative hardware. Organizations should track RT-Thread's security advisory channels and subscription lists for future notifications, particularly given the vendor's lack of response to early disclosure outreach (a potential indicator of slower security response processes).

Detection guidance

Monitor system logs and kernel messages for stack corruption indicators, segmentation faults, or unexpected process termination related to CAN operations. Endpoint Detection and Response (EDR) solutions can flag abnormal system calls from CAN handler processes or unusual local privilege escalation attempts. Network-based detection is limited due to the local attack vector, but observing unexpected CAN message patterns or malformed CAN frames may offer signals. For high-value deployments, implement code coverage and buffer overflow detection mechanisms (e.g., stack canaries or AddressSanitizer) during development and testing phases.

Why prioritize this

This vulnerability merits high priority because it combines a severe impact (full compromise of confidentiality, integrity, and availability), publicly available exploits, and a relatively permissive local access requirement that is realistic in many embedded and industrial scenarios. Although the attack surface is narrower than network-facing vulnerabilities, the consequences of exploitation are severe. The vendor's non-response to early disclosure suggests a delayed or uncertain patch timeline, increasing organizational risk. Prioritize patching for devices in critical operational roles or those with multiple users or maintenance personnel with local access.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH) reflects the severe impact on all three security properties (confidentiality, integrity, availability) balanced against the local-only attack vector. The score appropriately captures that while an attacker must be local, the low privilege requirement (standard user) and low complexity make this exploitable in many real-world settings. The availability of public exploits and evidence of vendor non-responsiveness compound the organizational risk beyond the base CVSS score alone, justifying elevated prioritization even within the HIGH severity band.

Frequently asked questions