CVE-2026-108952
Received Received - Intake

Memory Corruption in RT-Thread USB CDC Driver

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description
RT-Thread through 5.3.0 contains a memory corruption vulnerability in the legacy USB CDC virtual COM port driver that aliases rx_ringbuffer as a Serial V2 rt_serial_rx_fifo in _function_enable(). A connected USB host configuring the CDC device triggers writes past the ring buffer into struct vcom members and an invalid rt_free() on close, causing denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-108952
EUVD
EUVD-2026-97359

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
RT-Thread rt-thread 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-843 The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-108952 is a memory corruption vulnerability in RT-Thread through version 5.3.0 affecting the legacy USB CDC virtual COM port driver. When both RT_USB_DEVICE_CDC and RT_USING_SERIAL_V2 are enabled, the driver incorrectly aliases a ring buffer as a Serial V2 FIFO structure. This causes memory corruption when a USB host configures the device, leading to writes beyond the buffer into adjacent struct members and potential denial of service.

Detection Guidance

To detect this vulnerability, check if your RT-Thread system uses both RT_USB_DEVICE_CDC and RT_USING_SERIAL_V2 configurations. Inspect the cdc_vcom.c file for the problematic assignment in _function_enable(). Verify if the system is running RT-Thread version 5.3.0 or earlier. No specific commands are provided in the resources.

Impact Analysis

This vulnerability could cause system crashes or denial of service when a USB host interacts with the affected RT-Thread device. Memory corruption may lead to data corruption, instability, or unexpected behavior in applications relying on the USB CDC interface. Systems using RT-Thread with USB CDC and Serial V2 enabled are particularly at risk.

Compliance Impact

This vulnerability primarily causes memory corruption and denial of service in RT-Thread's USB CDC driver, which does not directly relate to data privacy or security controls required by GDPR or HIPAA. However, if exploited, it could lead to system instability or crashes, potentially disrupting operations that handle sensitive data. Compliance impact would depend on whether such disruptions affect data processing or availability of systems subject to these regulations.

Mitigation Strategies

Upgrade RT-Thread to a version containing the fix in components/legacy/usb/usbdevice/class/cdc_vcom.c. Disable either RT_USB_DEVICE_CDC or RT_USING_SERIAL_V2 if both are not required. Apply the patch from the GitHub pull request #11770 or commit ceef6e0ccd646aef61b907aeb9f29269d1caba50.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108952. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart