EUVD-2026-88482
GHSA-rgq7-v7jf-59g9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local low-privileged task access
-
DeliveryInvoke affected service routines repeatedly
-
ExploitTrigger premature termination leaking memory pools
-
ExecutionExhaust allocated memory
-
ImpactDenial of service / system halt
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Resource cleanup, leak prevention
|
| Exploitation Conditions | Exploitation requires the device to be running VxWorks 7 (versions 24.03 through 26.03) in a specific NON-DEFAULT configuration state, and the attacker must be able to invoke specific service routines that leak memory pools. Local access with low privileges (PR:L, AV:L) is required - this is not remotely exploitable and needs no user interaction. The primary limiting factors are the non-default configuration prerequisite (default installations are not affected) and the need for local low-privileged execution on the RTOS, which substantially constrain the realistic attacker population despite the CVSS AC:L rating. |
| Impact | This is a moderate-severity, low-real-world-priority issue. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 5.5) is internally consistent with the description: a local, low-privileged actor triggers a memory-pool leak (CWE-401) that terminates operations without freeing memory, yielding an availability-only impact (C:N/I:N/A:H). All exploitation signals point away from urgency: no EPSS score is provided, the CVE is not on CISA KEV (no confirmed active exploitation), and no public proof-of-concept is identified. The one significant caveat is the description's own words: exploitation requires 'specific, non-default configuration states' and 'specific service routines,' which the CVSS AC:L (low complexity) arguably understates - in practice the non-default prerequisite meaningfully narrows the exploitable population. Net: a real but self-reported, vendor-patched availability defect in a widely-deployed RTOS, not a widespread-exploitation priority. Note also a metadata conflict - the 'Information Disclosure' tag contradicts the CVSS impact (C:N), see data_quality_flags. |
| Exploit ScenarioDerived | On a VxWorks 7 device configured in the specific non-default mode, a local low-privileged task repeatedly invokes the affected service routines, each of which terminates its operation before releasing its allocated memory pools. Over time the leaked pools exhaust available memory, degrading or halting system operations (denial of service). No public exploit code has been identified, and there is no confidentiality or integrity impact. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 28, 2026
Memory pool exhaustion in Wind River VxWorks 7 releases 24.03 through 26.03 can terminate system operations when specific service routines are invoked while the device is in a non-default configuration state, because allocated memory pools are not released before the failure propagates. The weakness is local and availability-focused (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H per independent assessment): an attacker needs low-privileged local execution on the RTOS and the affected services must be reachable, and no user interaction or network path is required. Default installations are not affected, the configuration prerequisite plus the local-access requirement substantially narrow the realistic attacker population, and no public exploit identified at time of analysis; Wind River has fixed the issue in VxWorks 7 26.09. Overall this is a moderate-severity, low-real-world-priority issue rather than a broadly exploitable one.
RemediationAI
Wind River has released the fix in VxWorks 7 26.09; the primary and recommended action is to upgrade affected devices from versions 24.03 through 26.03 to VxWorks 7 26.09 (or a later release incorporating the fix) using the vendor's standard platform update process, and to validate that the previously used non-default configuration still behaves correctly after the upgrade since the fix changes service-routine memory handling. If an immediate upgrade is impossible, compensating controls should target the two prerequisites rather than the leak itself: (1) revert devices from the non-default configuration state that exposes the affected service routines back to the vendor-default configuration where operationally possible - the trade-off is loss of whatever custom functionality that configuration provided; (2) restrict local interactive access, consoles, debug interfaces and low-privileged local accounts to trusted personnel only, since the assessed vector requires PR:L/AV:L - the trade-off is reduced operational flexibility for field service and diagnostics; (3) disable or unload the specific optional service routines that process the leaking paths where the platform permits it - the trade-off is loss of that service while the device remains unpatched; and (4) monitor affected devices for steadily decreasing free memory in the relevant pools or for unexplained resets/terminations, which provides detection only and does not prevent exploitation. Because the impact is availability-only (pool exhaustion leading to termination), no confidentiality or integrity compensating control is required. Coordinate upgrade planning through Wind River support and the vendor CVE portal at https://support2.windriver.com/index.php?page=cve; no vendor-released patch was identified for anything other than VxWorks 7 26.09, and no public exploit code was identified for this issue at time of analysis.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is Wind River VxWorks 7, a real-time operating system (RTOS) widely deployed in embedded, industrial, automotive, aerospace and networking devices. The root cause is CWE-401 (Missing Release of Memory after Effective Lifetime), i.e. a memory leak: under specific, non-default configuration states, processing of certain service routines allocates memory pools that are never freed when the routine exits early, so the leak accumulates until the system runs out of the affected pool and terminates operations. Note that the provided tag set labels the issue 'Information Disclosure', but the CWE and the assessed CVSS vector (C:N/I:N/A:H) indicate the demonstrated impact is purely availability - resource exhaustion and system termination - with no confidentiality or integrity impact. The CPE cpe:2.3:a:wind_river_inc:vxworks_7:*:*:*:*:*:*:*:* denotes the VxWorks 7 product line broadly, so the operative restriction is the version range stated by the vendor (24.03 through 26.03) combined with the non-default configuration prerequisite. Because the flaw requires the attacker to be able to invoke the affected service routines locally with low privileges, it is an availability/resource-management defect on the device rather than a remote code execution or memory-corruption primitive. The vendor's own CVSS base score is 5.5 with AC:L, while the independent assessment rates AC:H to reflect the non-default configuration gate; both agree on scope-unchanged, no confidentiality/integrity impact and high availability impact.
Know when Vxworks 7 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Local low-priv task (AV:L/PR:L); I raise AC:L→AC:H because the description requires a specific non-default config and specific routines; availability-only (A:H, C:N/I:N).
Primary rating from Vendor (WindRiver).
CVSS VectorVendor: WindRiver
DescriptionCVE.org
Wind River VxWorks 7 24.03 through 26.03, a memory leak occurs under specific, non-default configuration states when processing specific service routines, causing the system to terminate operations before releasing allocated memory pools. Fixed in VxWorks 7 26.09
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Privilege escalation in Wind River VxWorks 7 (all versions up to 26.09) allows an authenticated low-privilege shell user
Memory corruption in Wind River VxWorks 7 occurs when a task passes crafted arguments to a specific system call, causing
Local denial of service in Wind River VxWorks 7 (all releases prior to 26.09) lets a low-privileged local task exhaust k
Local resource exhaustion in Wind River VxWorks 7 (versions prior to 26.09) allows a low-privileged local application to
Exploit-DB