Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    7 vulnerabilities

    CVE-2026-102006 (GCVE-0-2026-102006)

    Vulnerability from cvelistv5 – Published: 2026-09-28 20:46 – Updated: 2026-09-30 13:42
    VLAI
    Title
    VxWorks 7 Memory allocation
    Summary
    In Wind River VxWorks 7 prior to 26.09, specific system call arguments can result in the process management subsystem failing to properly release allocated kernel memory before terminating the calling application. Fixed in Version 26.09
    Severity
    5.5 (Medium)
    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-09-30 13:42 UTC
    CWE
    • CWE-401 - Missing release of memory after effective lifetime
    Assigner
    References
    Impacted products
    Date Public
    2026-09-28 20:29
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-102006",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-30T13:42:38.718375Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-30T13:42:51.624Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "RTOS"
          ],
          "product": "VxWorks 7",
          "vendor": "Wind River Systems Inc",
          "versions": [
            {
              "status": "affected",
              "version": "VxWorks 7"
            }
          ]
        }
      ],
      "datePublic": "2026-09-28T20:29:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "In Wind River VxWorks 7 prior to 26.09, specific system call arguments can result in the process management subsystem failing to properly release allocated kernel memory before terminating the calling application. Fixed in Version 26.09"
            }
          ],
          "value": "In Wind River VxWorks 7 prior to 26.09, specific system call arguments can result in the process management subsystem failing to properly release allocated kernel memory before terminating the calling application. Fixed in Version 26.09"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-130",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-130 Excessive Allocation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-401",
              "description": "CWE-401 Missing release of memory after effective lifetime",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-28T20:46:35.447Z",
        "orgId": "0bf9931a-6ebf-4f48-bd14-39ee5e1d61f8",
        "shortName": "WindRiver"
      },
      "references": [
        {
          "url": "https://support2.windriver.com/index.php?page=cve"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "VxWorks 7 Memory allocation",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "0bf9931a-6ebf-4f48-bd14-39ee5e1d61f8",
    "assignerShortName": "WindRiver",
    "cveId": "CVE-2026-102006",
    "datePublished": "2026-09-28T20:46:35.447Z",
    "dateReserved": "2026-09-28T17:08:33.425Z",
    "dateUpdated": "2026-09-30T13:42:51.624Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-102005 (GCVE-0-2026-102005)

    Vulnerability from cvelistv5 – Published: 2026-09-28 20:15 – Updated: 2026-09-28 20:43
    VLAI
    Title
    VxWorks Memory Allocation
    Summary
    Wind River VxWorks 7 24.03 through 26.03, a memory leak occurs under specific, non-default configuration states when processing specific service routines, causing the system to terminate operations before releasing allocated memory pools. Fixed in VxWorks 7 26.09
    Severity
    5.5 (Medium)
    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-09-28 20:43 UTC
    CWE
    • CWE-401 - Missing release of memory after effective lifetime
    Assigner
    References
    Impacted products
    Vendor Product Version
    Wind River Inc VxWorks 7 Affected: VxWorks 7
    		Create a notification for this product.
    Date Public
    2026-09-28 20:01
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-102005",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-28T20:43:09.369982Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-28T20:43:19.687Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "RTOS"
          ],
          "product": "VxWorks 7",
          "vendor": "Wind River Inc",
          "versions": [
            {
              "status": "affected",
              "version": "VxWorks 7"
            }
          ]
        }
      ],
      "datePublic": "2026-09-28T20:01:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Wind River VxWorks 7 24.03 through 26.03, a memory leak occurs under specific, non-default configuration states when processing specific service routines, causing the system to terminate operations before releasing allocated memory pools. Fixed in VxWorks 7 26.09"
            }
          ],
          "value": "Wind River VxWorks 7 24.03 through 26.03, a memory leak occurs under specific, non-default configuration states when processing specific service routines, causing the system to terminate operations before releasing allocated memory pools. Fixed in VxWorks 7 26.09"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-130",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-130 Excessive Allocation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-401",
              "description": "CWE-401 Missing release of memory after effective lifetime",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-28T20:15:52.709Z",
        "orgId": "0bf9931a-6ebf-4f48-bd14-39ee5e1d61f8",
        "shortName": "WindRiver"
      },
      "references": [
        {
          "url": "https://support2.windriver.com/index.php?page=cve"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "VxWorks Memory Allocation",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "0bf9931a-6ebf-4f48-bd14-39ee5e1d61f8",
    "assignerShortName": "WindRiver",
    "cveId": "CVE-2026-102005",
    "datePublished": "2026-09-28T20:15:52.709Z",
    "dateReserved": "2026-09-28T17:08:32.052Z",
    "dateUpdated": "2026-09-28T20:43:19.687Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-102004 (GCVE-0-2026-102004)

    Vulnerability from cvelistv5 – Published: 2026-09-28 19:47 – Updated: 2026-09-29 15:39
    VLAI
    Title
    VxWorks 7
    Summary
    Wind River VxWorks 7 prior to 26.09, specific system call arguments can result in memory corruption within the memory management subsystem. Fixed in Version 26.09
    Severity
    7.8 (High)
    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-09-29 03:55 UTC
    CWE
    Assigner
    References
    Impacted products
    Date Public
    2026-09-28 19:32
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-102004",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-29T03:55:29.801701Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-29T15:39:42.551Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "RTOS"
          ],
          "product": "VxWorks 7",
          "vendor": "Wind River Systems Inc",
          "versions": [
            {
              "status": "affected",
              "version": "VxWorks 7"
            }
          ]
        }
      ],
      "datePublic": "2026-09-28T19:32:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Wind River VxWorks 7 prior to 26.09, specific system call arguments can result in memory corruption within the memory management subsystem. Fixed in Version 26.09\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e"
            }
          ],
          "value": "Wind River VxWorks 7 prior to 26.09, specific system call arguments can result in memory corruption within the memory management subsystem. Fixed in Version 26.09"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-123",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-123 Buffer Manipulation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "CWE-787 Out-of-bounds write",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-28T19:47:18.640Z",
        "orgId": "0bf9931a-6ebf-4f48-bd14-39ee5e1d61f8",
        "shortName": "WindRiver"
      },
      "references": [
        {
          "url": "https://support2.windriver.com/index.php?page=cve"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "VxWorks 7",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "0bf9931a-6ebf-4f48-bd14-39ee5e1d61f8",
    "assignerShortName": "WindRiver",
    "cveId": "CVE-2026-102004",
    "datePublished": "2026-09-28T19:47:18.640Z",
    "dateReserved": "2026-09-28T17:08:20.953Z",
    "dateUpdated": "2026-09-29T15:39:42.551Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-97686 (GCVE-0-2026-97686)

    Vulnerability from cvelistv5 – Published: 2026-09-28 18:48 – Updated: 2026-09-28 21:41
    VLAI
    Title
    VxWorks 7 Memory Resource leak
    Summary
    Wind River VxWorks 7 prior to 26.09, specific system call arguments can result in the IPNET subsystem failing to properly release allocated kernel memory and system file descriptors before terminating the calling application. Fixed in Version 26.09.
    Severity
    5.5 (Medium)
    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-09-28 19:25 UTC
    CWE
    • CWE-772 - Missing release of resource after effective lifetime
    Assigner
    References
    Impacted products
    Vendor Product Version
    Wind River VxWorks 7 Affected: VxWorks 7
    		Create a notification for this product.
    Date Public
    2026-09-28 18:39
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-97686",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-28T19:25:35.769605Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-28T19:25:43.054Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "RTOS"
          ],
          "product": "VxWorks 7",
          "vendor": "Wind River",
          "versions": [
            {
              "status": "affected",
              "version": "VxWorks 7"
            }
          ]
        }
      ],
      "datePublic": "2026-09-28T18:39:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Wind River VxWorks 7 prior to 26.09, specific system call arguments can result in the IPNET subsystem failing to properly release allocated kernel memory and system file descriptors before terminating the calling application. Fixed in Version 26.09.\u0026nbsp;\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\n\n\u003cdiv\u003e\n\n\n\n\u003c/div\u003e"
            }
          ],
          "value": "Wind River VxWorks 7 prior to 26.09, specific system call arguments can result in the IPNET subsystem failing to properly release allocated kernel memory and system file descriptors before terminating the calling application. Fixed in Version 26.09."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-469",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-469 HTTP DoS"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-772",
              "description": "CWE-772 Missing release of resource after effective lifetime",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-28T21:41:50.103Z",
        "orgId": "0bf9931a-6ebf-4f48-bd14-39ee5e1d61f8",
        "shortName": "WindRiver"
      },
      "references": [
        {
          "url": "https://support2.windriver.com/index.php?page=cve\u0026order_by=cve_modified_date\u0026order_way=asc#list"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "VxWorks 7 Memory Resource leak",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "0bf9931a-6ebf-4f48-bd14-39ee5e1d61f8",
    "assignerShortName": "WindRiver",
    "cveId": "CVE-2026-97686",
    "datePublished": "2026-09-28T18:48:23.773Z",
    "dateReserved": "2026-09-24T21:12:17.354Z",
    "dateUpdated": "2026-09-28T21:41:50.103Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2025-26503 (GCVE-0-2025-26503)

    Vulnerability from cvelistv5 – Published: 2025-09-18 18:46 – Updated: 2026-02-26 17:48
    VLAI
    Title
    Buffer manipulation
    Summary
    A crafted system call argument can cause memory corruption.
    Severity
    6.7 (Medium)
    CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2025-09-20 03:55 UTC
    CWE
    • CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer
    Assigner
    References
    Impacted products
    Vendor Product Version
    Wind River Systems Inc VxWorks 7 Affected: 7.0.0 , < 25.03 (custom)
    		Create a notification for this product.
    Date Public
    2025-09-18 17:10
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-26503",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-20T03:55:43.084182Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-26T17:48:27.781Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "VxWorks 7"
          ],
          "product": "VxWorks 7",
          "vendor": "Wind River Systems Inc",
          "versions": [
            {
              "lessThan": "25.03",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2025-09-18T17:10:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A crafted system call argument can cause memory corruption.\n\n\u003cbr\u003e"
            }
          ],
          "value": "A crafted system call argument can cause memory corruption."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-123",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-123 Buffer Manipulation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-119",
              "description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-18T18:46:44.962Z",
        "orgId": "0bf9931a-6ebf-4f48-bd14-39ee5e1d61f8",
        "shortName": "WindRiver"
      },
      "references": [
        {
          "url": "https://support2.windriver.com/index.php?page=cve\u0026on=view\u0026id=CVE-2025-26503"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Buffer manipulation",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "0bf9931a-6ebf-4f48-bd14-39ee5e1d61f8",
    "assignerShortName": "WindRiver",
    "cveId": "CVE-2025-26503",
    "datePublished": "2025-09-18T18:46:44.962Z",
    "dateReserved": "2025-02-11T20:11:10.093Z",
    "dateUpdated": "2026-02-26T17:48:27.781Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2025-26499 (GCVE-0-2025-26499)

    Vulnerability from cvelistv5 – Published: 2025-09-11 16:46 – Updated: 2025-09-11 20:37
    VLAI
    Summary
    Under heavy system utilization a random race condition can occur during authentication or token refresh operation. This flaw allows one user to be granted a token intended for another user, resulting in impersonation until the session is ended. This flaw cannot be intentionally exploited due to the required concurring action by two users. However, if the event occurs a user would be inadvertently exposed to another user’s system rights and data access.
    Severity
    6 (Medium)
    CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2025-09-11 20:37 UTC
    CWE
    • CWE-270 - CWE - CWE-270: Privilege Context Switching Error (4.17)
    Assigner
    References
    Impacted products
    Date Public
    2025-09-11 16:38
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-26499",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-11T20:37:38.098093Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-11T20:37:54.876Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Wind River Studio Developer"
          ],
          "product": "Wind River Studio Developer",
          "vendor": "Wind River Studio Developer",
          "versions": [
            {
              "lessThan": "24.11\u003e=",
              "status": "affected",
              "version": "24.11",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2025-09-11T16:38:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eUnder heavy system utilization a random race condition can occur during authentication or token refresh operation. This flaw allows one user to be granted a token intended for another user, resulting in impersonation until the session is ended. This flaw cannot be intentionally exploited due to the required concurring action by two users. However, if the event occurs a user would be inadvertently exposed to another user\u2019s system rights and data access.\u003c/p\u003e\u003cp\u003e\u0026nbsp;\u003c/p\u003e\n\n\u003cbr\u003e"
            }
          ],
          "value": "Under heavy system utilization a random race condition can occur during authentication or token refresh operation. This flaw allows one user to be granted a token intended for another user, resulting in impersonation until the session is ended. This flaw cannot be intentionally exploited due to the required concurring action by two users. However, if the event occurs a user would be inadvertently exposed to another user\u2019s system rights and data access."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-114",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-114: CAPEC - CAPEC-114: Authentication Abuse (Version 3.9)"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-270",
              "description": "CWE-270: CWE - CWE-270: Privilege Context Switching Error (4.17)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-11T16:46:28.575Z",
        "orgId": "0bf9931a-6ebf-4f48-bd14-39ee5e1d61f8",
        "shortName": "WindRiver"
      },
      "references": [
        {
          "url": "https://www.windriver.com/security/vulnerability-responses/CVE-2025-26499"
        },
        {
          "url": "https://support2.windriver.com/index.php?page=cve\u0026on=view\u0026id=CVE-2025-26499"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "0bf9931a-6ebf-4f48-bd14-39ee5e1d61f8",
    "assignerShortName": "WindRiver",
    "cveId": "CVE-2025-26499",
    "datePublished": "2025-09-11T16:46:28.575Z",
    "dateReserved": "2025-02-11T20:11:10.092Z",
    "dateUpdated": "2025-09-11T20:37:54.876Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2025-26500 (GCVE-0-2025-26500)

    Vulnerability from cvelistv5 – Published: 2025-03-21 22:20 – Updated: 2025-03-24 13:19
    VLAI
    Title
    VxWorks 7 USB Failure
    Summary
    : Uncontrolled Resource Consumption vulnerability in Wind River Systems VxWorks 7 on VxWorks allows Excessive Allocation.   Specifically crafted USB packets may lead to the system becoming unavailable This issue affects VxWorks 7: from 22.06 through 24.03.
    Severity
    4.6 (Medium)
    CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2025-03-24 13:19 UTC
    CWE
    • CWE-400 - Uncontrolled Resource Consumption
    Assigner
    References
    Impacted products
    Vendor Product Version
    Wind River Systems VxWorks 7 Affected: 22.06 , ≤ 24.03 (date)
    		Create a notification for this product.
    Date Public
    2025-03-17 23:00
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-26500",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-24T13:19:25.092364Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-24T13:19:36.412Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "VxWorks"
          ],
          "product": "VxWorks 7",
          "vendor": "Wind River Systems",
          "versions": [
            {
              "lessThanOrEqual": "24.03",
              "status": "affected",
              "version": "22.06",
              "versionType": "date"
            }
          ]
        }
      ],
      "datePublic": "2025-03-17T23:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": ": Uncontrolled Resource Consumption vulnerability in Wind River Systems VxWorks 7 on VxWorks allows Excessive Allocation.\u0026nbsp;\u0026nbsp;\n\nSpecifically crafted USB packets may lead to the system becoming unavailable\n\n\u003cp\u003eThis issue affects VxWorks 7: from 22.06 through 24.03.\u003c/p\u003e"
            }
          ],
          "value": ": Uncontrolled Resource Consumption vulnerability in Wind River Systems VxWorks 7 on VxWorks allows Excessive Allocation.\u00a0\u00a0\n\nSpecifically crafted USB packets may lead to the system becoming unavailable\n\nThis issue affects VxWorks 7: from 22.06 through 24.03."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "None that are known.\u0026nbsp;"
            }
          ],
          "value": "None that are known."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-130",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-130 Excessive Allocation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "PHYSICAL",
            "availabilityImpact": "HIGH",
            "baseScore": 4.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-03-21T22:20:36.101Z",
        "orgId": "0bf9931a-6ebf-4f48-bd14-39ee5e1d61f8",
        "shortName": "WindRiver"
      },
      "references": [
        {
          "url": "https://support2.windriver.com/index.php?page=cve\u0026on=view\u0026id=CVE-2025-26500"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://support2.windriver.com/index.php?page=cve\u0026amp;on=view\u0026amp;id=CVE-2025-26500\"\u003ehttps://support2.windriver.com/index.php?page=cve\u0026amp;on=view\u0026amp;id=CVE-2025-26500\u003c/a\u003e\u003cbr\u003e"
            }
          ],
          "value": "https://support2.windriver.com/index.php?page=cve\u0026on=view\u0026id=CVE-2025-26500"
        }
      ],
      "source": {
        "advisory": "https://support2.windriver.com/index.php?page=cve\u0026on=view\u0026id=CVE",
        "defect": [
          "Internal Testing"
        ],
        "discovery": "INTERNAL"
      },
      "title": "VxWorks 7 USB Failure",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "0bf9931a-6ebf-4f48-bd14-39ee5e1d61f8",
    "assignerShortName": "WindRiver",
    "cveId": "CVE-2025-26500",
    "datePublished": "2025-03-21T22:20:36.101Z",
    "dateReserved": "2025-02-11T20:11:10.092Z",
    "dateUpdated": "2025-03-24T13:19:36.412Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}