CVE-2026-14607

Publié : 3 juillet 2026

Modifié : 3 juillet 2026

Score CVSS

5.5

MEDIUM

Description détaillée

A weakness has been identified in RT-Thread up to 5.0.2. This affects the function sys_getaddrinfo of the file components/lwp/lwp_syscall.c. Executing a manipulation of the argument ai_addr can lead to memory corruption. The attack can only be executed locally. The exploit has been made available to the public and could be used for attacks. The pull request to fix this issue awaits acceptance.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Références et Patchs

https://github.com/RT-Thread/rt-thread/https://github.com/RT-Thread/rt-thread/issues/11428 https://github.com/RT-Thread/rt-thread/pull/11454 https://vuldb.com/cve/CVE-2026-14607 https://vuldb.com/submit/844622 https://vuldb.com/vuln/376115 https://vuldb.com/vuln/376115/cti

Dernières Vulnérabilités

CVE-2026-58597

Insufficient ui warning of dangerous operations in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.

VOIR DÉTAILS

CVE-2026-58524

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.

VOIR DÉTAILS

CVE-2026-58522

Relative path traversal in Microsoft Edge for Android allows an unauthorized attacker to disclose information locally.

VOIR DÉTAILS