RT-Thread releases through version 5.3.0 have a flaw in the legacy USB CDC virtual COM port driver that aliases an internal ring buffer with a serial interface structure during a function enable operation. When a USB host configures the CDC device, writes continue past the expected buffer boundary, corrupting adjacent structure fields and eventually triggering an invalid free call upon driver closure. The result is a loss of system responsiveness, effectively a denial of service. The weakness aligns with improper handling of memory boundaries, identified as CWE‑843.

The vulnerability affects any device running RT‑Thread firmware prior to the patch, specifically versions up to and including 5.3.0. Implementations that enable the legacy USB CDC VCOM driver are at risk; the vendor is Thread Project and the product is RT‑Thread. No particular platform or peripheral specifications are limited beyond the use of the affected USB driver component.

The flaw requires a USB host to interact with the device using the CDC protocol, which is an authenticated local interaction. An attacker with physical or sandbox USB access could establish the CDC session, trigger out‑of‑bounds writes, and cause a crash. The CVSS score of 5.1 indicates moderate severity, and the EPSS score is not available, leaving the exploitation probability uncertain. The vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog, and no public exploit code has been documented. Nonetheless, the ease of interaction via USB makes the risk notable for embedded systems exposed to untrusted hosts.