CVE-2025-5865 is a high severity (CVSS 8.0) memory corruption in RT-Thread 5.1.0, the embedded real time operating system. The sys_select function in the lightweight process syscall code mishandles the timeout argument. The record lists no fixed version, so follow the project issue and review whether your firmware uses this component.
What's affected
RT-Thread 5.1.0, per the record. Other versions may share the code but the record does not say.
The record names sys_select in rt-thread/components/lwp/lwp_syscall.c.
The record gives no fixed version. The project issue tracker is the place to confirm status. The record quotes the vendor as saying the timeout parameter should be checked for kernel mode access and used temporarily in kernel memory.
How to check if you're exposed
RT-Thread is an embedded operating system, so the version is the one compiled into your firmware, not something installed on a host. Check your build.
grep -n "RT_VERSION" include/rtdef.h
git -C /path/to/rt-thread describe --tags
Then check whether your firmware enables the lightweight process component, which is where the record places the flaw. Look for the lwp component in your build configuration, and whether user mode applications can issue the system call.
What to do now
- Find which of your products ship RT-Thread 5.1.0 and whether they enable the lwp component.
- Follow the project issue for a fix, and update your RT-Thread source when a corrected commit is available.
- Limit which applications can run on the device and which networks can reach it, since the CVSS vector shows adjacent network access and a low privilege requirement.
- Plan a firmware update path for deployed devices, because embedded fleets often lag behind.
- Keep management and configuration interfaces off the internet and off guest networks.
- Record the firmware or build version of every affected device so you can match it to a fix when one is published.
Why it matters
The record ties this to the timeout argument. The syscall handler uses a pointer supplied by the caller without confirming it can be accessed correctly in kernel mode. When kernel code dereferences a bad pointer from user space, memory can be corrupted. The record quotes the vendor, who explains that the timeout should be checked and copied into kernel memory for temporary use. That is the standard pattern for system call handlers: validate, copy, then use the copy.
The record classifies the weakness as CWE-119 (Improper Restriction of Operations within Memory Bounds).
Memory corruption bugs like this one come from copying more data into a fixed region than it can hold, or reading and writing at a position that was never checked. Depending on the target, the result ranges from a crash to a change in program behavior. Embedded and native code is hit hardest because there is usually no managed runtime to catch the mistake.
The lasting fix is a bounds check on every length or index that arrives from outside the component. Until that fix ships, the practical defense is to limit who can reach the vulnerable code path at all, which usually means keeping management interfaces and internal services off untrusted networks.
The record shows this CVE is not in the CISA Known Exploited Vulnerabilities catalog.
Quick check
Is there a fixed version?
The record gives none. Follow the issue linked in the sources and rebuild your firmware once a fix lands.
Why is the access vector adjacent?
The CVSS vector uses adjacent network access with a low privilege requirement, so the attacker needs a position on the same network segment as the device.
Sources
Last reviewed: 18 October 2026.
