Threat database

CVE-2026-104018 is an improper privilege management vulnerability in the command shell of Wind River VxWorks 7 when configured to enforce per-user command privileges. This flaw allows an authenticated user with limited privileges to execute commands without the usual privilege checks, leading to privilege escalation. The vulnerability affects all versions of VxWorks 7 prior to 26.09 and has been fixed in version 26.09. The CVSS score is 8.8, indicating a high severity impact on confidentiality, integrity, and availability.

CVE-2026-102006 is a medium severity vulnerability in Wind River VxWorks 7 prior to version 26.09. It involves improper release of allocated kernel memory in the process management subsystem when specific system call arguments are used, leading to memory not being freed after the calling application terminates. This issue has been fixed in version 26.09.

CVE-2026-102005 is a medium severity memory leak vulnerability in Wind River VxWorks 7 versions 24.03 through 26.03. The issue occurs under specific, non-default configuration states when processing certain service routines, causing the system to terminate operations without releasing allocated memory pools. This vulnerability was fixed in version 26.09.

CVE-2026-102004 is a high-severity vulnerability in Wind River VxWorks 7 prior to version 26.09. It involves an out-of-bounds write caused by specific system call arguments leading to memory corruption in the memory management subsystem. This flaw can result in confidentiality, integrity, and availability impacts. The issue has been fixed in version 26.09.

CVE-2026-97686 is a medium severity vulnerability in Wind River VxWorks 7 prior to version 26.09. It involves the IPNET subsystem failing to release allocated kernel memory and system file descriptors when certain system call arguments are used, leading to resource leaks. This issue is fixed in version 26.09.

A crafted system call argument can cause memory corruption.