{"id":"CVE-2026-108952","summary":"RT-Thread through 5.3.0 Memory Corruption via USB CDC VCOM Driver","details":"RT-Thread through 5.3.0 contains a memory corruption vulnerability in the legacy USB CDC virtual COM port driver that aliases rx_ringbuffer as a Serial V2 rt_serial_rx_fifo in _function_enable(). A connected USB host configuring the CDC device triggers writes past the ring buffer into struct vcom members and an invalid rt_free() on close, causing denial of service.","modified":"2026-10-14T07:03:46.791418927Z","published":"2026-10-12T12:13:04.800Z","database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-843"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-108952.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-108952.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108952"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/rt-thread-through-5.3.0-memory-corruption-via-usb-cdc-vcom-driver"},{"type":"REPORT","url":"https://github.com/RT-Thread/rt-thread/issues/11739"},{"type":"FIX","url":"https://github.com/RT-Thread/rt-thread/commit/ceef6e0ccd646aef61b907aeb9f29269d1caba50"},{"type":"FIX","url":"https://github.com/RT-Thread/rt-thread/pull/11770"},{"type":"PACKAGE","url":"https://github.com/RT-Thread/rt-thread"},{"type":"ARTICLE","url":"https://github.com/RT-Thread/rt-thread/blob/99428a1e7f7447955aa860f7c969273a12095b8f/components/legacy/usb/usbdevice/class/cdc_vcom.c#L518"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/rt-thread/rt-thread","events":[{"introduced":"0"},{"fixed":"99428a1e7f7447955aa860f7c969273a12095b8f"},{"fixed":"ceef6e0ccd646aef61b907aeb9f29269d1caba50"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"5.3.0"}],"source":["DESCRIPTION","REFERENCES"]}}],"versions":["v5.0.2","v4.1.1","v5.0.1","v5.0.0","v4.1.1-beta","v4.1.0","v4.1.0-beta","v4.0.3","v4.0.2","v4.0.1","v4.0.0","v3.1.1","v3.1.0","v3.0.4","v3.0.3","v3.0.2","v3.0.1","v3.0.0","v2.1.0","v2.0.0","v2.0.0_rc","v2.0.0_beta","v2.0.0_alpha","v1.2.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108952.json","vanir_signatures":[{"digest":{"function_hash":"333116887857843652900686936491332496018","length":1005},"id":"CVE-2026-108952-0c64cf36","signature_type":"Function","signature_version":"v1","source":"https://github.com/rt-thread/rt-thread/commit/ceef6e0ccd646aef61b907aeb9f29269d1caba50","target":{"file":"components/legacy/usb/usbdevice/class/cdc_vcom.c","function":"_ep_out_handler"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/rt-thread/rt-thread/commit/ceef6e0ccd646aef61b907aeb9f29269d1caba50","target":{"file":"components/legacy/usb/usbdevice/class/cdc_vcom.c"},"deprecated":false,"digest":{"line_hashes":["68361000054125288439293457367347969932","209948331879837137011452932252954132833","295054476284094187586297448598472685407","266964851913120007012141701872169551617","217548761637050845794365951454200608955","142597726504140784616026925386054442987","168868443852639813324107155658727356111","50017314101946679478570562562018758014","193508530225008336350745077723208306764","299888475265199870957936582671902452116","10041296236045830189030244878329120307","12917479249528388384694031027220456519","116561388344317125474128819278364699584","38497839936752537931919368238945974406","85745446454239800801583093844865817424","325710287027395763481512147398885075252","168668975996930730415541752874711575137","22432277196201980745353476902977797163","90793347545410090445020859626082226970","5518574747913422792882539253528672494","189720316932837461328930882489993218071","294297310097390293867709002410154043557","43752262284883266074165173993061765240","127227304070004199132269737630284063556","290546848338944142605061910977380473716","36676927639605325663532601507179820116","276791502830914261594419743215745622900","230844405184635404441501322097719333365","285047740542195534643869515067797895182","149723348400924040862984067436689173761","230336640973476034834546774025959076333"],"threshold":0.9},"id":"CVE-2026-108952-43fb04e2","signature_type":"Line"},{"id":"CVE-2026-108952-9b947c7f","signature_type":"Function","signature_version":"v1","source":"https://github.com/rt-thread/rt-thread/commit/ceef6e0ccd646aef61b907aeb9f29269d1caba50","target":{"file":"components/legacy/usb/usbdevice/class/cdc_vcom.c","function":"_vcom_getc"},"deprecated":false,"digest":{"length":557,"function_hash":"123362867140610982643248236182551891382"}}],"vanir_signatures_modified":"2026-10-14T07:03:46Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}]}