CVE-2026-102005

Received Received - Intake

Memory Leak in Wind River VxWorks

Publication date: 2026-09-28

Last updated on: 2026-09-28

Assigner: WindRiver

Description

Wind River VxWorks 7 24.03 through 26.03, a memory leak occurs under specific, non-default configuration states when processing specific service routines, causing the system to terminate operations before releasing allocated memory pools. Fixed in VxWorks 7 26.09

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-28

Last Modified

2026-09-28

Generated

2026-09-29

AI Q&A

2026-09-29

EPSS Evaluated

N/A

NVD

CVE-2026-102005

EUVD

EUVD-2026-88482

Affected Vendors & Products

Vendor	Product	Version / Range
wind_river	vxworks	26.09
wind_river	vxworks	From 24.03 (inc) to 26.03 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-401	The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

Attack-Flow Graph

Executive Summary

This vulnerability in Wind River VxWorks 7 versions 24.03 through 26.03 involves a memory leak that occurs under specific non-default configurations when processing certain service routines. The system fails to release allocated memory pools, leading to termination of operations before cleanup.

Detection Guidance

This vulnerability involves a memory leak in Wind River VxWorks under specific non-default configurations. Detection requires checking system logs for memory pool exhaustion or termination events during service routine processing. Monitor memory usage trends and look for crashes in affected versions (24.03 to 26.03). No specific commands are provided in the context.

Impact Analysis

The memory leak can cause system instability or crashes due to exhausted memory resources. This may disrupt operations relying on VxWorks, especially in real-time or embedded systems where consistent performance is critical.

Compliance Impact

This vulnerability causes memory leaks in specific configurations of Wind River VxWorks, potentially leading to system instability or crashes. While not directly tied to data privacy, such instability could disrupt systems handling sensitive data, indirectly impacting compliance with standards like GDPR or HIPAA that require reliable data processing and security controls.

Mitigation Strategies

Upgrade Wind River VxWorks to version 26.09 or later to address the memory leak issue. Ensure the system is configured to avoid the specific non-default states that trigger the vulnerability.

Hi! I’m here to help you understand CVE-2026-102005. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70