CVE-2026-108952

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-108952
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108952.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-108952
Published
2026-10-12T12:13:04Z
Modified
2026-10-14T07:03:46Z
Severity
  • 5.1 (Medium) CVSS_V4 - CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
RT-Thread through 5.3.0 Memory Corruption via USB CDC VCOM Driver
Details

RT-Thread through 5.3.0 contains a memory corruption vulnerability in the legacy USB CDC virtual COM port driver that aliases rx_ringbuffer as a Serial V2 rt_serial_rx_fifo in _function_enable(). A connected USB host configuring the CDC device triggers writes past the ring buffer into struct vcom members and an invalid rt_free() on close, causing denial of service.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-843"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-108952.json"
}
References

Affected packages

Git / github.com/rt-thread/rt-thread

Affected ranges

Type
GIT
Repo
https://github.com/rt-thread/rt-thread
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
99428a1e7f7447955aa860f7c969273a12095b8f
Fixed
ceef6e0ccd646aef61b907aeb9f29269d1caba50
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "5.3.0"
        }
    ],
    "source":  [
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

v1.*
v1.2.0
v2.*
v2.0.0
v2.0.0_alpha
v2.0.0_beta
v2.0.0_rc
v2.1.0
v3.*
v3.0.0
v3.0.1
v3.0.2
v3.0.3
v3.0.4
v3.1.0
v3.1.1
v4.*
v4.0.0
v4.0.1
v4.0.2
v4.0.3
v4.1.0
v4.1.0-beta
v4.1.1
v4.1.1-beta
v5.*
v5.0.0
v5.0.1
v5.0.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108952.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "333116887857843652900686936491332496018",
            "length":  1005
        },
        "id":  "CVE-2026-108952-0c64cf36",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/rt-thread/rt-thread/commit/ceef6e0ccd646aef61b907aeb9f29269d1caba50",
        "target":  {
            "file":  "components/legacy/usb/usbdevice/class/cdc_vcom.c",
            "function":  "_ep_out_handler"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "68361000054125288439293457367347969932",
                "209948331879837137011452932252954132833",
                "295054476284094187586297448598472685407",
                "266964851913120007012141701872169551617",
                "217548761637050845794365951454200608955",
                "142597726504140784616026925386054442987",
                "168868443852639813324107155658727356111",
                "50017314101946679478570562562018758014",
                "193508530225008336350745077723208306764",
                "299888475265199870957936582671902452116",
                "10041296236045830189030244878329120307",
                "12917479249528388384694031027220456519",
                "116561388344317125474128819278364699584",
                "38497839936752537931919368238945974406",
                "85745446454239800801583093844865817424",
                "325710287027395763481512147398885075252",
                "168668975996930730415541752874711575137",
                "22432277196201980745353476902977797163",
                "90793347545410090445020859626082226970",
                "5518574747913422792882539253528672494",
                "189720316932837461328930882489993218071",
                "294297310097390293867709002410154043557",
                "43752262284883266074165173993061765240",
                "127227304070004199132269737630284063556",
                "290546848338944142605061910977380473716",
                "36676927639605325663532601507179820116",
                "276791502830914261594419743215745622900",
                "230844405184635404441501322097719333365",
                "285047740542195534643869515067797895182",
                "149723348400924040862984067436689173761",
                "230336640973476034834546774025959076333"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-108952-43fb04e2",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/rt-thread/rt-thread/commit/ceef6e0ccd646aef61b907aeb9f29269d1caba50",
        "target":  {
            "file":  "components/legacy/usb/usbdevice/class/cdc_vcom.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "123362867140610982643248236182551891382",
            "length":  557
        },
        "id":  "CVE-2026-108952-9b947c7f",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/rt-thread/rt-thread/commit/ceef6e0ccd646aef61b907aeb9f29269d1caba50",
        "target":  {
            "file":  "components/legacy/usb/usbdevice/class/cdc_vcom.c",
            "function":  "_vcom_getc"
        }
    }
]
vanir_signatures_modified 
"2026-10-14T07:03:46Z"