RT-Thread CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM RT-Thread CVE published 2026-10-12

CVE-2026-108952

RT-Thread through 5.3.0 contains a memory corruption vulnerability in the legacy USB CDC virtual COM port driver. A connected USB host configuring the CDC device triggers writes past the ring buffer into struct vcom members and an invalid rt_free() on close, causing denial of service. This vulnerability affects systems using the USB CDC VCOM Driver, particularly those with exposed USB ports. Defenders sho [truncated]