What’s Vulnerable › Vulnerabilities
CVE-2020-28895: integer overflow in calloc
- Severity: high (CVSS 7.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 1.5% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2021-02-03 · updated 2026-06-17
- Weakness: CWE-190
Description
In Wind River VxWorks, memory allocator has a possible overflow in calculating the memory block's size to be allocated by calloc(). As a result, the actual memory allocated is smaller than the buffer size specified by the arguments, leading to memory corruption.
Affected products
- Oracle Communications Eagle: from 46.8.0 through 48.6.2; from 46.9.1 through 46.9.3; 46.7.0
- Windriver Vxworks: from 6.9 before 6.9.4.12; 6.9.4.12, 6.9.4.12-rolling_cumulative_patch_layer1 — fixed in 6.9.4.12
How to fix
Upgrade to a fixed version: Windriver Vxworks 6.9.4.12. Check the vendor advisory for mitigations.
References
- https://support2.windriver.com/index.php?page=cve&on=view&id=CVE-2020-28895
- https://support2.windriver.com/index.php?page=defects&on=view&id=V7LIBC-1327
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://support2.windriver.com/index.php?page=cve&on=view&id=CVE-2020-28895
- https://support2.windriver.com/index.php?page=defects&on=view&id=V7LIBC-1327
- https://www.oracle.com/security-alerts/cpuapr2022.html
Get alerted when CVE-2020-28895 or the next vulnerability affects your stack