The flaw exists in the sys_getaddrinfo function implemented in the lwp_syscall.c file of RT-Thread firmware. An attacker can manipulate the ai_addr argument to cause a buffer overflow that corrupts memory beyond its intended bounds. The CVE record does not describe direct code execution, but the resulting memory corruption can disrupt system operation, potentially destabilizing the device or yielding further compromise in a broader attack chain.

Devices that run RT-Thread version 5.0.2 or earlier are affected, as the unpatched sys_getaddrinfo routine resides in the firmware binary of all such builds. The vulnerability is present regardless of network exposure because the flaw is triggered by local manipulation of the function's arguments.

The CVSS score of 6.8 places the issue in the medium severity range, while an EPSS score of less than 1% indicates a low probability of exploitation in the wild. The vulnerability is not listed in CISA's KEV catalog. Attacks require local execution privileges; no documented remote exploitation path exists. Publicly available exploit code demonstrates that a local attacker could trigger the defect and corrupt memory, potentially affecting device stability or providing a foothold for further attacks.