CVE-2026-14629: RT-Thread Divide-by-Zero Denial of Service Vulnerability

Technical summary

CVE-2026-14629 is a divide-by-zero vulnerability in RT-Thread's lightweight process (lwp) subsystem, specifically within the sys_ioctl, read, and write functions of components/lwp/lwp_syscall.c. The vulnerability stems from insufficient input validation in the parameter handler, allowing a local or remote authenticated user to supply malformed parameters that cause integer division by zero. This is categorized as CWE-369 (Divide By Zero) and CWE-404 (Improper Resource Validation). The flaw affects RT-Thread versions through 5.2.2. A fix is pending in an open pull request but has not yet been merged into a stable release.

Business impact

This vulnerability degrades service availability for RT-Thread deployments. In embedded or IoT environments using RT-Thread as the operating system, an authenticated user could crash the kernel, forcing administrators to reboot affected devices. Frequent exploitation would require repeated manual recovery, increasing operational overhead. Organizations relying on RT-Thread for mission-critical embedded systems should assess whether any of their devices are exposed to untrusted authenticated users. The medium severity and authentication requirement limit the attack surface but do not eliminate risk.

Affected systems

RT-Thread versions up to and including 5.2.2 are affected. No specific list of downstream vendors or products was provided in the vulnerability data. Organizations running RT-Thread directly or as part of an embedded platform should verify their version number and check vendor advisories for patched releases or workarounds. The vulnerability requires authenticated network or local access to exploit.

Exploitability

The vulnerability has a published proof-of-concept and is actively exploitable. However, exploitation requires pre-existing authentication (network or local user credentials), which moderates the risk profile. An attacker cannot exploit this without first gaining valid access. The technical complexity is low—the attack is straightforward manipulation of system call parameters. Remote exploitation is possible if the RT-Thread instance exposes network-accessible authenticated interfaces.

Remediation

Upgrade to a patched version of RT-Thread once released. A pull request addressing this issue is pending acceptance into the main codebase. Administrators should monitor the RT-Thread project repository and vendor communications for the next stable release that includes the fix. Until a patch is available, restrict authenticated access to RT-Thread systems to trusted users and limit network-facing authenticated services. Consider network segmentation to reduce the surface area for remote exploitation.

Patch guidance

Verify the RT-Thread project's release notes and pull request tracker for confirmation that a stable patch is available. Once released, administrators should update to the first version after 5.2.2 that includes the fix. Patch testing should be performed in a non-production environment before deployment. If running RT-Thread as part of a larger platform or appliance, check with your vendor for a platform-specific patched release, as vendors may bundle the fix into their own update cycle.

Detection guidance

Monitor RT-Thread logs for repeated sys_ioctl, read, or write system call failures, particularly those that result in kernel panic or service restart. Network-based detection is limited without direct access to RT-Thread debugging facilities; however, monitoring for unexpected service interruptions or crashes on affected devices may indicate exploitation attempts. If RT-Thread is instrumented with crash reporting, correlate crashes with unusual parameter values in sys_ioctl calls. Intrusion detection on authenticated sessions may help identify lateral movement by compromised users attempting to trigger the flaw.

Why prioritize this

Although the CVSS score is 4.3 (medium) and the vulnerability requires authentication, the existence of published exploit code and the simplicity of triggering a denial of service justify prompt patching. Organizations with large RT-Thread deployments or those exposed to untrusted authenticated users should prioritize updating once a patch is available. The pending nature of the fix suggests a short window between disclosure and patch availability.

Risk score, explained

The CVSS:3.1 score of 4.3 reflects the availability impact (denial of service), low attack complexity, and the requirement for authenticated access. No confidentiality or integrity impact is present. The vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) indicates network-accessible attack vector, low complexity, low privilege requirement, no user interaction needed, and contained scope. This places the vulnerability in the medium category, appropriate for a privilege-escalation-free denial of service with authentication required.

Frequently asked questions