CVE-2026-108952

Name of the Vulnerable Software and Affected Versions RT-Thread versions prior to 5.3.1

Description A memory corruption issue exists in the legacy USB CDC virtual COM port driver. The problem occurs when rx ringbuffer is aliased as a Serial V2 rt serial rx fifo within the function enable() function. A connected USB host configuring the CDC device can trigger writes that exceed the ring buffer, overwriting struct vcom members. This leads to an invalid rt free() call upon closing the connection, resulting in a denial of service.

Recommendations Update RT-Thread to a version newer than 5.3.0. As a temporary mitigation, restrict the use of the legacy USB CDC virtual COM port driver.