CVE-2026-14629
RT-Thread Parameter lwp_syscall.c sys_ioctl divide by zero
- State
- Published
- Severity
- 5.3 Medium
- Published
- Jul 4, 2026
- Updated
- Jul 6, 2026
- Reserved
- Jul 3, 2026
Description
A flaw has been found in RT-Thread up to 5.2.2. Affected is the function read/write/sys_ioctl of the file components/lwp/lwp_syscall.c of the component Parameter Handler. Executing a manipulation can lead to divide by zero. The attack may be launched remotely. The exploit has been published and may be used. The pull request to fix this issue awaits acceptance.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 4.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R | VulDB |
| 3.0 | 4.3 Medium | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R | VulDB |
| 2.0 | 4.0 Medium | AV:N/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
RT-Threadn/a |
|
References
- VDB-376145 | RT-Thread Parameter lwp_syscall.c sys_ioctl divide by zerovdb-entrytechnical-description
- VDB-376145 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- CVE-2026-14629 | CVE Analysis and Reportthird-party-advisory
- Submit #845610 | RT-Thread v5.2.2 Improper Handling of Parametersthird-party-advisory
- https://github.com/RT-Thread/rt-thread/issues/11429exploitissue-tracking
- https://github.com/RT-Thread/rt-thread/pull/11453issue-trackingpatch
- https://github.com/RT-Thread/rt-thread/product
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.