What is CVE-2026-102006?

CVE-2026-102006 is a medium-severity vulnerability in Wind River Systems Inc Vxworks 7, classified under Missing Release of Memory after Effective Lifetime. CVSS score: 5.5/10. Published 2026-09-28.

How severe is CVE-2026-102006?

Medium severity. CVSS v3 base score is 5.5 out of 10.

Vulnerability in Wind River Systems Inc Vxworks 7

CVE-2026-102006

In Wind River VxWorks 7 prior to 26.09, specific system call arguments can result in the process management subsystem failing to properly release allocated kernel memory before terminating the calling application. Fixed in Version 26.09

Published 2026-09-28.

CVSS v3 metric

CVSS v3 base score 5.5 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Wind River Systems Inc Vxworks 7 — versions VxWorks 7

Weakness classification (CWE)

CWE-401 — Missing Release of Memory after Effective Lifetime

References

0bf9931a-6ebf-4f48-bd14-39ee5e1d61f8

Frequently asked questions

What is CVE-2026-102006?: CVE-2026-102006 is a medium-severity vulnerability in Wind River Systems Inc Vxworks 7, classified under Missing Release of Memory after Effective Lifetime. CVSS score: 5.5/10. Published 2026-09-28.
How severe is CVE-2026-102006?: Medium severity. CVSS v3 base score is 5.5 out of 10.