CVE-2023-51787 affects Wind River VxWorks 7 releases 22.09 and 23.03. When a task or POSIX thread that uses OpenSSL exits, limited per task memory is not freed. The record rates it High at 7.5. Check Wind River's advisory for the fixed release.
What's affected
The record names VxWorks 7 22.09 and 23.03. It does not list a fixed version, and the Wind River advisory page could not be read in full when we checked, so we cannot state one. Check the Wind River support advisory for CVE-2023-51787 and its patch guidance.
There is also a mismatch inside the record. The description is about a memory leak, which is an availability problem, but the CWE is CWE-200 (exposure of sensitive information) and the vector scores confidentiality as High with no availability impact. We flag this so you read the score with care.
The record gives a CVSS score of 7.5 (High). The CVSS vector reads as follows. The attack can be reached over the network, and the complexity is low. No account is needed. No user interaction is required. Impact on confidentiality is high, on integrity none, and on availability none. The weakness class is CWE-200.
How to check if you're exposed
Check the VxWorks 7 release your device runs, which is part of the product's build and version information in your development environment. Releases 22.09 and 23.03 are named in the record.
Then ask whether your software creates and ends tasks or threads that use OpenSSL. A system that starts long lived tasks once is less exposed to a per task leak than one that spawns and exits tasks often.
What to do now
- Identify devices running VxWorks 7 22.09 or 23.03.
- Obtain the patch or update guidance from Wind River support for this CVE.
- Review how your application creates and ends tasks that use OpenSSL.
- Monitor memory use on long running devices to spot slow leaks.
- Plan the update with your device vendor, since embedded updates need testing.
Why it matters
A memory leak in an embedded operating system is a slow problem. Each time a task that uses OpenSSL exits, a small amount of limited per task memory stays allocated. On a device that cycles through many tasks, memory runs out over time and the device misbehaves or restarts.
The record classifies the flaw under information exposure, which does not match the description, and the vector reports no availability impact. Treat the 7.5 score as a prompt to read the vendor advisory, not as a precise measure of the leak's effect.
Embedded devices live a long time and are updated rarely. Keeping a list of which devices run which operating system release is what makes a CVE like this answerable in minutes.
Quick check
Is there a fixed version?
The record does not name one. Use the Wind River advisory for the patch.
Why does the score look odd for a memory leak?
The record lists CWE-200 and a confidentiality impact, while the description describes a leak. Read the vendor advisory for the real effect.
Sources
Last reviewed: 19 October 2026.
