VxWorks 7 EUVD-2026-88467

Requires the attacker to already have local execution as at least a low-privileged task on the VxWorks 7 device (PR:L, AV:L, UI:N), and to invoke a specific system call with crafted arguments that trigger memory corruption in the memory-management subsystem. Exploitation is limited to systems running VxWorks 7 versions prior to 26.09 and to deployments where untrusted or lower-trust code can run on the target - devices that only execute vendor-signed firmware with no local code-execution surface are not remotely exploitable via this flaw. The specific vulnerable system call and argument pattern are not disclosed, so a working exploit must first identify the affected call.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 7.8 HIGH) is internally consistent with the description: a low-privileged local task passes crafted arguments to a specific system call and triggers memory corruption (CWE-787 out-of-bounds write) in the VxWorks memory-management subsystem, yielding full confidentiality, integrity, and availability impact on the running RTOS instance. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or imminent widespread exploitation - this reads as a vendor-discovered/self-reported hardening fix rather than a KEV-grade emergency. The key tempering factor is the LOCAL attack vector plus PR:L: an attacker must already be able to execute code (a task) on the device, which on many embedded/RTOS deployments is a meaningful barrier. Net: technically serious (memory corruption in the memory manager can mean privilege escalation to kernel context or reliable DoS on safety/real-time systems), but real-world urgency is moderate absent remote reachability or exploitation signals. Priority is elevated only where untrusted or lower-trust code already runs on the VxWorks target.

A low-privileged application task already running on a VxWorks 7 device (e.g., a compromised or attacker-supplied process on an embedded controller) invokes a specific system call with malformed arguments, corrupting kernel memory-management structures. The attacker leverages the out-of-bounds write to escalate to kernel/supervisor context or to crash the RTOS, disrupting a real-time or safety-critical function. No public exploit code was identified at time of analysis, and exploitation requires prior local code execution on the target.