CVE-2026-108952: RT-Thread through 5.3.0 Memory Corruption via USB CDC VCOM Driver
RT-Thread through 5.3.0 contains a memory corruption vulnerability in the legacy USB CDC virtual COM port driver that aliases rxringbuffer as a Serial V2 rtserialrxfifo in functionenable(). A connected USB host configuring the CDC device triggers writes past the ring buffer into struct vcom members and an invalid rtfree() on close, causing denial of service.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
RT-Thread deployments through 5.3.0 that use the legacy USB CDC virtual COM port driver are exposed. Exploitation requires a USB host connected to the affected CDC device.
What must an attacker be able to do to trigger the flaw?
An attacker needs to act as, or control, a connected USB host and configure the device's CDC interface. No privileges or user interaction are required according to the supplied vector.
What is the practical impact of successful exploitation?
The malformed driver state causes writes beyond the receive ring buffer into vcom structure members and can lead to an invalid rt_free() when the connection closes. The described impact is denial of service.
What can be done while a fix is being deployed?
The provided information supports reducing exposure by avoiding use of the legacy USB CDC virtual COM port driver and restricting access to the device's USB connection to trusted hosts. No other workaround is specified.