Rt-Thread · Rt-Thread · CVE-2026-108952
RT-Thread through 5.3.0 contains a memory corruption vulnerability in the legacy USB CDC virtual COM port driver that aliases rx ringbuffer as a Serial V2 rt serial rx fifo in function enable(). A connected USB host configuring the CDC device triggers writes past the ring buffer into struct vcom members and an invalid rt free() on close, causing denial of service.