Wind River VxWorks EUVD-2026-88440

Exploitation requires the attacker to already be executing a local, low-privileged application on the VxWorks 7 target (AV:L/PR:L) and to invoke system calls with the specific argument values that trigger the IPNET subsystem's failure to release kernel memory and file descriptors. The impact is confined to availability - no confidentiality or integrity effect - and no user interaction is needed (UI:N). Limiting factors: it cannot be triggered remotely or without prior code-execution access on the device, so it is realistically a concern only where untrusted or low-trust tasks/applications run on the same VxWorks image (multi-tenant, third-party-app, or compromised-process scenarios); pre-26.09 firmware is the only affected condition.

This is a genuine but low-to-moderate priority issue best characterized as a local, availability-only denial-of-service. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 5.5) is internally consistent with the CWE-772 (missing resource release) description: an already-authorized low-privilege application on the device passes specific system-call arguments that cause the IPNET network subsystem to leak kernel memory and file descriptors on each invocation, eventually exhausting kernel resources. There is no confidentiality or integrity impact (C:N/I:N), so the 'Information Disclosure' tag directly contradicts the vector and the description - this is availability degradation, not an info leak. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so no public exploit identified at time of analysis; the low real-world urgency is driven by the local attack vector (attacker must already run code on the device) rather than any network-facing exposure. Net: a real, vendor-confirmed reliability/DoS bug worth patching on multi-tenant or untrusted-workload VxWorks deployments, but not an emergency - it is not a high-CVSS-but-fake issue, rather a correctly-scored medium whose local prerequisite bounds real risk.

A low-privilege application or task already running on a VxWorks 7 target repeatedly issues syscalls with the specific argument pattern that trips the IPNET leak, and each call permanently loses kernel memory and file descriptors. Over time the kernel exhausts its memory pool or fd table, degrading or crashing networking and other services on the device. No public exploit code is identified in the available data, and exploitation requires local low-privileged execution rather than remote access.