Stack-Based Buffer Overflow in RT-Thread RTOS Affecting ls1c CAN Handler
CVE-2026-14605

8.5HIGH

Key Information:

Vendor: RT-Thread
Status: Rt-thread
Vendor: CVE Published:; 3 July 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-14605?

A vulnerability has been discovered in the RT-Thread Real-Time Operating System (RTOS) related to the ls1c CAN Handler. Specifically, the issue lies within the 'recvmsg' function located in bsp/loongson/ls1cdev/libraries/ls1c_can.h. This vulnerability can lead to a stack-based buffer overflow, which could potentially allow an attacker with local access to exploit the system. Despite being contacted about this vulnerability disclosure, the vendor did not respond. Public exploits are available, raising concerns for users running affected versions of the RT-Thread RTOS, particularly prior to version 5.0.2.

Affected Version(s)

RT-Thread 5.0.0

RT-Thread 5.0.1

RT-Thread 5.0.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-14605 - Proof of Concept