CVE-2026-14607CWE-119

RT-Thread lwp_syscall.c sys_getaddrinfo memory corruption

Medium · published July 3, 2026

CVSS v4.0
6.8
EPSS
0%
Percentile
5.6
In the wild
Unconfirmed
What it is

A weakness has been identified in RT-Thread up to 5.0.2. This affects the function sys_getaddrinfo of the file components/lwp/lwp_syscall.c. Executing a manipulation of the argument ai_addr can lead to memory corruption. The attack can only be executed locally. The exploit has been made available to the public and could be used for attacks. The pull request to fix this issue awaits acceptance.

The record
Technical detail
CVSS v4.0
6.8 · MEDIUM
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P
EPSS
0.00167 · 5.6th percentile
Weakness
CWE-119 · Improper Restriction of Operations within the Bounds of a Memory Buffer
Published
2026-07-03T19:45Z
EPSS history
Timeline
  • 03 JUL 19:45Z
    RT-Thread lwp_syscall.c sys_getaddrinfo memory corruption
    cvelistv5