This vulnerability in RT-Thread up to version 5.0.2 involves a stack-based buffer overflow in the CAN_Receive function of the SWM341 CAN Handler component. The issue arises from improper handling of input in the bsp/synwit/libraries/SWM341_CSL/CMSIS/DeviceSupport/SWM341.h file. An attacker with local access can manipulate inputs to trigger the overflow. The vulnerability has a CVSS 4.0 score of 8.5, indicating high severity with low attack complexity but requiring local privileges. The vendor was notified but did not respond, and no official patch or remediation is currently available. Public exploit code has been released.

Successful exploitation can result in a stack-based buffer overflow, potentially allowing an attacker with local access to execute arbitrary code or cause a denial of service. The vulnerability has high impact on confidentiality, integrity, and availability as indicated by the CVSS vector. Since the attack requires local access, remote exploitation is not feasible without prior access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or vendor response is available, users should restrict local access to trusted parties only and monitor for suspicious activity related to the CAN_Receive function. Consider applying any community or third-party mitigations if available, and track vendor updates closely.