What’s Vulnerable › Vulnerabilities
CVE-2020-35198
- Severity: critical (CVSS 9.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 2.5% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2021-05-12 · updated 2026-06-17
- Weakness: CWE-190
Description
An issue was discovered in Wind River VxWorks 7. The memory allocator has a possible integer overflow in calculating a memory block's size to be allocated by calloc(). As a result, the actual memory allocated is smaller than the buffer size specified by the arguments, leading to memory corruption.
Affected products
- Oracle Communications Eagle: from 46.8.0 through 46.8.2; from 46.9.1 through 46.9.3; 46.7.0
- Windriver Vxworks: from 6.9 before 6.9.4.12; from 7.0 before 21.03; 6.9.4.12, 6.9.4.12-rolling_cumulative_patch_layer1, 6.9.4.12-rolling_cumulative_patch_layer2 — fixed in 21.03, 6.9.4.12
How to fix
Upgrade to a fixed version: Windriver Vxworks 21.03, 6.9.4.12. Check the vendor advisory for mitigations.
References
- https://support2.windriver.com/index.php?page=cve&on=view&id=CVE-2020-35198
- https://support2.windriver.com/index.php?page=security-notices
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://support2.windriver.com/index.php?page=cve&on=view&id=CVE-2020-35198
- https://support2.windriver.com/index.php?page=security-notices
- https://www.oracle.com/security-alerts/cpuapr2022.html
Get alerted when CVE-2020-35198 or the next vulnerability affects your stack