Medium severity · published Sep 28, 2026
CVE-2026-102006
VxWorks 7 Memory allocation
5.5
CVSS
0.1%
EPSS
No
On KEV
Description
In Wind River VxWorks 7 prior to 26.09, specific system call arguments can result in the process management subsystem failing to properly release allocated kernel memory before terminating the calling application. Fixed in Version 26.09
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 1% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
V7
VxWorks 7 · Wind River Systems Inc
VxWorks 7 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-102006
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-102006
support2.windriver.com
https://support2.windriver.com/index.php?page=cve
More from VxWorks 7
8.8
CVE-2026-104018
VxWorks 7 improper privilege management
7.8
CVE-2026-102004
Wind River VxWorks 7 prior to 26.09, specific system call arguments can result in memory corruption within the memory management subsystem
6.7
CVE-2025-26503
Buffer manipulation