RT-Thread through 5.3.0 Memory Corruption via USB CDC VCOM Driver

Advisories

RT-Thread through 5.3.0 Memory Corruption via USB CDC VCOM Driver

severity: medium
date: 10/12/2026
Affecting: rt-thread <= 5.3.0
CVE: CVE-2026-108952
CWE: CWE-843 Access of Resource Using Incompatible Type ('Type Confusion')
CVSS: 5.1
CVSS V4 Vector: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
References: https://github.com/RT-Thread/rt-thread/issues/11739
https://github.com/RT-Thread/rt-thread/pull/11770
https://github.com/RT-Thread/rt-thread/commit/ceef6e0ccd646aef61b907aeb9f29269d1caba50
https://github.com/RT-Thread/rt-thread/blob/99428a1e7f7447955aa860f7c969273a12095b8f/components/legacy/usb/usbdevice/class/cdc_vcom.c#L518
https://github.com/RT-Thread/rt-thread
Credit: Jaeyeong Lee, Ijae Kim, Myeonghun Pak, Yuho Choi, Taegyu Kim
Description: RT-Thread through 5.3.0 contains a memory corruption vulnerability in the legacy USB CDC virtual COM port driver that aliases rx_ringbuffer as a Serial V2 rt_serial_rx_fifo in _function_enable(). A connected USB host configuring the CDC device triggers writes past the ring buffer into struct vcom members and an invalid rt_free() on close, causing denial of service.

Ready to get Started?

Explore VulnCheck, a next-generation Cyber Threat Intelligence platform, which provides exploit and vulnerability intelligence to help you prioritize and remediate vulnerabilities that matter.

Vulnerability Prioritization
Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.
Early Warning System
Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

Schedule a Demo