CVE-2026-97686

VxWorks 7 Memory Resource leak

Published Sep 28, 2026 CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Description

Wind River VxWorks 7 prior to 26.09, specific system call arguments can result in the IPNET subsystem failing to properly release allocated kernel memory and system file descriptors before terminating the calling application. Fixed in Version 26.09.

Analysis

Technical impact

Wind River VxWorks 7 versions prior to 26.09 contain a flaw where specific system call arguments can cause the IPNET subsystem to fail to release allocated kernel memory and system file descriptors before the calling application terminates. The leak can accumulate over time, exhausting available memory and descriptor resources, potentially leading to application or system failures and denial of service.

Affected Systems

Wind River’s VxWorks 7 operating system, specifically all versions preceding 26.09. No additional vendor or product variants are cited in the CVE record.

Risk and Exploitability

The CVSS score of 5.5 classifies the flaw as moderate severity. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog, indicating limited publicly known exploitation. Based on the description, the likely attack vector involves sending crafted system call arguments to the vulnerable IPNET subsystem, which may be reachable locally or remotely depending on the deployment context of VxWorks 7.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Wind River

VxWorks 7

unaffected

Version	Status	Constraints
`VxWorks 7`	affected	—

No data.

Vendor Product Versions

Windriver

Vxworks

Version	Status	Scheme	Platform
`VxWorks 7`	affected	generic	['rtos']

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade VxWorks 7 to version 26.09 or later, which incorporates the fix for the memory and descriptor leak.
If an upgrade is not feasible, restrict or isolate the use of the affected system calls and confine the IPNET subsystem to a hardened environment to reduce exposure.
Monitor memory usage and file descriptor counts for sudden increases, and configure alerts to detect anomalies that may indicate exploitation attempts.

Generated by OpenCVE AI on September 28, 2026 at 23:35 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.098% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://support2.windriver.com/index.php?page=cve&order_by=cve_modified_date&order_way=asc#list

History

Sep 29, 2026 1:15 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Windriver Windriver vxworks
Vendors & Products		Windriver Windriver vxworks

Sep 28, 2026 10:00 PM Description updated View changes

Type	Values Removed	Values Added
Description	Wind River VxWorks 7 prior to 26.09, specific system call arguments can result in the IPNET subsystem failing to properly release allocated kernel memory and system file descriptors before terminating the calling application. Fixed in Version 26.09. Security Researcher: Zhi Yang Bingren Wu Finding	Wind River VxWorks 7 prior to 26.09, specific system call arguments can result in the IPNET subsystem failing to properly release allocated kernel memory and system file descriptors before terminating the calling application. Fixed in Version 26.09.

Sep 28, 2026 8:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 28, 2026 7:00 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Wind River VxWorks 7 prior to 26.09, specific system call arguments can result in the IPNET subsystem failing to properly release allocated kernel memory and system file descriptors before terminating the calling application. Fixed in Version 26.09. Security Researcher: Zhi Yang Bingren Wu Finding
Title		VxWorks 7 Memory Resource leak
Weaknesses		CWE-772
References		https://support2.windriver.com/index.php?page=cve&order_by=cve_modified_date&order_way=asc#list
Metrics		cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}`