CVE-2026-14606: Stack Buffer Overflow in RT-Thread SWM341 CAN Handler

Technical summary

CVE-2026-14606 is a stack-based buffer overflow (CWE-119, CWE-121) in the SWM341 CAN handler library bundled with RT-Thread. The flaw exists in the CAN_Receive function within bsp/synwit/libraries/SWM341_CSL/CMSIS/DeviceSupport/SWM341.h. The vulnerability stems from improper bounds checking when handling CAN message data, permitting an attacker to write beyond allocated stack memory. Exploitation requires local access and low privilege context, but no user interaction is required. The CVSS 3.1 vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a score of 7.8 (HIGH), indicating confidentiality, integrity, and availability impact.

Business impact

For organizations deploying RT-Thread in embedded CAN bus applications—particularly automotive, industrial control, and IoT devices—this vulnerability poses a direct threat to system stability and data security. A compromised local user could escalate privileges, exfiltrate sensitive data, or disable critical vehicle or industrial equipment. In connected vehicle or manufacturing contexts, this could lead to physical safety risks, regulatory compliance violations, and operational downtime. The public availability of exploit code accelerates the window during which unpatched systems remain at active risk.

Affected systems

RT-Thread versions up to and including 5.0.2 are affected. Devices using the SWM341 microcontroller with the bundled CAN driver library are directly impacted. This includes Synwit-based SWM341 reference implementations and any embedded system integrating RT-Thread with SWM341 CAN support. Systems already updated beyond version 5.0.2 or using alternative CAN drivers are not affected.

Exploitability

Exploitability is moderate to high. The vulnerability requires local access and execution with at least low-privilege permissions, but exploitation is straightforward once those preconditions are met. No user interaction or complex attack chain is necessary. Critically, proof-of-concept exploit code is publicly available, significantly lowering the technical barrier for attackers. This shifts the threat from theoretical to imminent for unpatched systems in multi-user or supply-chain compromise scenarios.

Remediation

Immediate action is required: upgrade RT-Thread to a version newer than 5.0.2 that addresses the buffer overflow in the SWM341 CAN handler. Verify the patched version against the vendor's official release notes. Pending patching, apply strict access controls to limit local user privileges and restrict CAN driver functionality to trusted processes only. Consider network-level isolation of devices reliant on this component.

Patch guidance

Contact your RT-Thread vendor or check the official RT-Thread repository for releases after 5.0.2 that explicitly address CVE-2026-14606. Apply patches systematically across your deployment, prioritizing devices in safety-critical or high-availability roles. Test patches in a staging environment first to ensure CAN functionality remains intact post-update. Verify that your firmware or bootloader is also updated if they include bundled SWM341 libraries.

Detection guidance

Monitor for failed CAN message reception or driver crashes following suspicious local process activity. Stack overflow attempts may trigger segmentation faults or unexpected reboots. In environments with process auditing enabled, correlate CAN driver interactions with unauthorized local users or privilege escalation attempts. Intrusion detection systems should flag anomalous CAN bus traffic volumes or malformed CAN frames if the device exposes CAN interfaces to observable network segments. Forensic analysis of core dumps or system logs may reveal stack corruption patterns.

Why prioritize this

This vulnerability merits high-priority remediation due to the combination of public exploit availability, local privilege requirement (common in multi-tenant embedded systems), and full impact on confidentiality, integrity, and availability. While attack surface is limited to local users, the exploitability is proven and low-friction. Organizations running RT-Thread in automotive, industrial, or safety-critical contexts should treat this as urgent.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH) reflects the serious nature of the vulnerability: unauthenticated local code execution leading to complete system compromise. The low attack complexity (AC:L) and lack of user interaction requirement (UI:N) amplify risk. The absence of scope change (S:U) limits impact to the affected system only, preventing lateral movement by default, but the presence of public exploit code and the vendor's non-responsiveness elevate practical risk beyond the numeric score.

Frequently asked questions