CVE-2026-14607: RT-Thread lwp_syscall.c sys_getaddrinfo memory corruption
Published Jul 3, 2026
·Updated
A weakness has been identified in RT-Thread up to 5.0.2. This affects the function sysgetaddrinfo of the file components/lwp/lwpsyscall.c. Executing a manipulation of the argument aiaddr can lead to memory corruption. The attack can only be executed locally. The exploit has been made available to the public and could be used for attacks. The pull request to fix this issue awaits acceptance.
Affected Software
1 affected component
RT-Thread<=5.0.2
Event History
Jul 3, 2026
CVE Published
via MITRE·07:45 PM
Data Sourced
via MITRE·07:45 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·08:16 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2026-14607?
The severity of CVE-2026-14607 is rated as medium with a score of 5.5.
2
How do I fix CVE-2026-14607?
To fix CVE-2026-14607, update RT-Thread to version 5.0.3 or later.
3
What type of vulnerability is CVE-2026-14607?
CVE-2026-14607 is categorized as a buffer overflow vulnerability.
4
Who is affected by CVE-2026-14607?
CVE-2026-14607 affects users of RT-Thread versions up to 5.0.2.
5
Can CVE-2026-14607 be exploited remotely?
No, CVE-2026-14607 can only be exploited locally.