Threat database

CVE-2026-104018 is an improper privilege management vulnerability in the command shell of Wind River VxWorks 7 when configured to enforce per-user command privileges. This flaw allows an authenticated user with limited privileges to execute commands without the usual privilege checks, leading to privilege escalation. The vulnerability affects all versions of VxWorks 7 prior to 26.09 and has been fixed in version 26.09. The CVSS score is 8.8, indicating a high severity impact on confidentiality, integrity, and availability.

CVE-2026-102006 is a medium severity vulnerability in Wind River VxWorks 7 prior to version 26.09. It involves improper release of allocated kernel memory in the process management subsystem when specific system call arguments are used, leading to memory not being freed after the calling application terminates. This issue has been fixed in version 26.09.

CVE-2026-102004 is a high-severity vulnerability in Wind River VxWorks 7 prior to version 26.09. It involves an out-of-bounds write caused by specific system call arguments leading to memory corruption in the memory management subsystem. This flaw can result in confidentiality, integrity, and availability impacts. The issue has been fixed in version 26.09.

A crafted system call argument can cause memory corruption.