Wind River VxWorks 7 contains a memory leak in the process management subsystem that occurs when specific system call arguments are used. The bug prevents the subsystem from freeing kernel memory before terminating an application, potentially leading to resource exhaustion and service disruption. The weakness is a classic memory leak (CWE‑401).

Wind River Systems VxWorks 7 versions earlier than 26.09 are affected. The issue is fixed in release 26.09 and later.

With a CVSS score of 5.5, the vulnerability presents a moderate risk. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating no known exploitation yet. The likely attack vector is a local process that passes the vulnerable system call arguments, which could be triggered by a malicious user with sufficient privileges or by an upstream component that calls the system call incorrectly.