CVE-2025-26503 - Vulnerability Details - OpenCVE

A crafted system call argument can cause memory corruption.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0002.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Windriver	Vxworks

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors	Products
Windriver	Vxworks

Advisories

Source	ID	Title
EUVD	EUVD-2025-30202	A crafted system call argument can cause memory corruption.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://support2.windriver.com/index.php?page=cve&on=view&id=CVE-2025-26503

History

Fri, 19 Sep 2025 09:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Windriver Windriver vxworks
Vendors & Products		Windriver Windriver vxworks

Thu, 18 Sep 2025 19:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Thu, 18 Sep 2025 19:00:00 +0000

Type	Values Removed	Values Added
Description		A crafted system call argument can cause memory corruption.
Title		Buffer manipulation
Weaknesses		CWE-119
References		https://support2.windriver.com/index.php?page=cve&on=view&id=CVE-2025-26503
Metrics		cvssV3_1 `{'score': 6.7, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}`

MITRE

Status: PUBLISHED

Assigner: WindRiver

Published: 2025-09-18T18:46:44.962Z

Updated: 2025-09-20T03:55:42.625Z

Reserved: 2025-02-11T20:11:10.093Z

Link: CVE-2025-26503

Vulnrichment

Updated: 2025-09-18T18:58:53.226Z

NVD

Status : Awaiting Analysis

Published: 2025-09-18T19:15:37.293

Modified: 2025-09-19T16:00:27.847

Link: CVE-2025-26503

Redhat

No data.

OpenCVE Enrichment

Updated: 2025-09-19T09:35:23Z

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-26503", "assignerOrgId": "0bf9931a-6ebf-4f48-bd14-39ee5e1d61f8", "state": "PUBLISHED", "assignerShortName": "WindRiver", "dateReserved": "2025-02-11T20:11:10.093Z", "datePublished": "2025-09-18T18:46:44.962Z", "dateUpdated": "2025-09-20T03:55:42.625Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["VxWorks 7"], "product": "VxWorks 7", "vendor": "Wind River Systems Inc", "versions": [{"lessThan": "25.03", "status": "affected", "version": "7.0.0", "versionType": "custom"}]}], "datePublic": "2025-09-18T17:10:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "A crafted system call argument can cause memory corruption.\n\n<br>"}], "value": "A crafted system call argument can cause memory corruption."}], "impacts": [{"capecId": "CAPEC-123", "descriptions": [{"lang": "en", "value": "CAPEC-123 Buffer Manipulation"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-119", "description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "0bf9931a-6ebf-4f48-bd14-39ee5e1d61f8", "shortName": "WindRiver", "dateUpdated": "2025-09-18T18:46:44.962Z"}, "references": [{"url": "https://support2.windriver.com/index.php?page=cve&on=view&id=CVE-2025-26503"}], "source": {"discovery": "UNKNOWN"}, "title": "Buffer manipulation", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-19T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2025-26503"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-20T03:55:42.625Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-26503", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-09-18T18:57:10.328086Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-18T18:58:53.226Z"}}], "cna": {"title": "Buffer manipulation", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-123", "descriptions": [{"lang": "en", "value": "CAPEC-123 Buffer Manipulation"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Wind River Systems Inc", "product": "VxWorks 7", "versions": [{"status": "affected", "version": "7.0.0", "lessThan": "25.03", "versionType": "custom"}], "platforms": ["VxWorks 7"], "defaultStatus": "unaffected"}], "datePublic": "2025-09-18T17:10:00.000Z", "references": [{"url": "https://support2.windriver.com/index.php?page=cve&on=view&id=CVE-2025-26503"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "A crafted system call argument can cause memory corruption.", "supportingMedia": [{"type": "text/html", "value": "A crafted system call argument can cause memory corruption.\n\n<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-119", "description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer"}]}], "providerMetadata": {"orgId": "0bf9931a-6ebf-4f48-bd14-39ee5e1d61f8", "shortName": "WindRiver", "dateUpdated": "2025-09-18T18:46:44.962Z"}}}, "cveMetadata": {"cveId": "CVE-2025-26503", "state": "PUBLISHED", "dateUpdated": "2025-09-20T03:55:42.625Z", "dateReserved": "2025-02-11T20:11:10.093Z", "assignerOrgId": "0bf9931a-6ebf-4f48-bd14-39ee5e1d61f8", "datePublished": "2025-09-18T18:46:44.962Z", "assignerShortName": "WindRiver"}, "dataVersion": "5.1"}