CVE-2025-5869 is a high severity (CVSS 8.0) memory corruption in RT-Thread 5.1.0, the embedded real time operating system. The sys_recvfrom function in the lightweight process syscall code mishandles the from argument. The record lists no fixed version, so follow the project issue and review whether your firmware uses this component.
What's affected
RT-Thread 5.1.0, per the record. Other versions may share the code but the record does not say.
The record names sys_recvfrom in rt-thread/components/lwp/lwp_syscall.c.
The record gives no fixed version. The project issue tracker is the place to confirm status.
How to check if you're exposed
RT-Thread is an embedded operating system, so the version is the one compiled into your firmware, not something installed on a host. Check your build.
grep -n "RT_VERSION" include/rtdef.h
git -C /path/to/rt-thread describe --tags
Then check whether your firmware enables the lightweight process component, which is where the record places the flaw. Look for the lwp component in your build configuration, and whether user mode applications can issue the system call.
What to do now
- Find which of your products ship RT-Thread 5.1.0 and whether they enable the lwp component.
- Follow the project issue for a fix, and update your RT-Thread source when a corrected commit is available.
- Limit which applications can run on the device and which networks can reach it, since the CVSS vector shows adjacent network access and a low privilege requirement.
- Plan a firmware update path for deployed devices, because embedded fleets often lag behind.
- Keep management and configuration interfaces off the internet and off guest networks.
- Record the firmware or build version of every affected device so you can match it to a fix when one is published.
Why it matters
The record ties this to the from argument of sys_recvfrom, which receives the address of a sender. A pointer supplied from user space is used inside the kernel handler without enough validation, so memory can be corrupted. The usual pattern for a safe handler is to validate the user pointer and copy data across the boundary with checked helpers.
The record classifies the weakness as CWE-119 (Improper Restriction of Operations within Memory Bounds).
Memory corruption bugs like this one come from copying more data into a fixed region than it can hold, or reading and writing at a position that was never checked. Depending on the target, the result ranges from a crash to a change in program behavior. Embedded and native code is hit hardest because there is usually no managed runtime to catch the mistake.
The lasting fix is a bounds check on every length or index that arrives from outside the component. Until that fix ships, the practical defense is to limit who can reach the vulnerable code path at all, which usually means keeping management interfaces and internal services off untrusted networks.
The record shows this CVE is not in the CISA Known Exploited Vulnerabilities catalog.
Quick check
Is there a fixed version?
The record gives none. Follow the issue linked in the sources and rebuild your firmware once a fix lands.
Why is the access vector adjacent?
The CVSS vector uses adjacent network access with a low privilege requirement, so the attacker needs a position on the same network segment as the device.
Sources
Last reviewed: 18 October 2026.
