Detections
Analytics
Wind River VxWorks 7 24.03 through 26.03 Memory Leak DoS (CVE-2026-102005)
medium Nessus Plugin ID 358455
Synopsis
The remote VxWorks device is potentially affected by a denial of service vulnerability.Description
According to its self-reported version, the remote device is running Wind River VxWorks 7. Releases 24.03 through 26.03 are affected by a denial of service vulnerability:- In Wind River VxWorks 7 24.03 through 26.03, a memory leak occurs under specific, non-default configuration states when processing specific service routines, causing the system to terminate operations before releasing allocated memory pools. (CVE-2026-102005)
Note that Nessus cannot determine the VxWorks 7 release designation (for example 26.03) from the detected operating system version, and cannot confirm the non-default configuration required for exploitation. This finding is therefore reported as a potential vulnerability.
Note that Nessus has not tested for this issue but has instead relied only on the OS version.
Solution
Upgrade to Wind River VxWorks 7 release 26.09 or later, or contact the device vendor to obtain the appropriate update.See Also
Plugin Details
Severity: Medium
ID: 358455
File Name: vxworks_cve-2026-102005.nasl
Version: 1.1
Type: Remote
Family: Misc.
Published: 10/1/2026
Updated: 10/1/2026
Configuration: Enable paranoid mode
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Low
Score: 3
Percentile: 23.62
CVSS v2
Risk Factor: Medium
Base Score: 4.6
Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C
CVSS Score Source: CVE-2026-102005
CVSS v3
Risk Factor: Medium
Base Score: 5.5
Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability Information
CPE: cpe:/o:windriver:vxworks
Required KB Items: Settings/ParanoidReport, Host/VxWorks
Patch Publication Date: 9/28/2026
Vulnerability Publication Date: 9/28/2026
Reference Information
CVE: CVE-2026-102005