Search

Find a vulnerability

Search criteria

    4 vulnerabilities found for QNX Hypervisor by BlackBerry Ltd

    CVE-2026-50077 (GCVE-0-2026-50077)

    Vulnerability from cvelistv5 – Published: 2026-11-10 19:28 – Updated: 2026-11-10 19:28
    VLAI
    Title
    Vulnerabilities in the QNX Virtual Machine (QVM) affect QNX Hypervisor and QNX Hypervisor for Safety
    Summary
    Invalid Memory Access via the MSI-X table in QVM could allow an attacker in the guest to execute arbitrary code in the QVM to cause memory corruption, information disclosure or a crash of the QVM.
    CWE
    Assigner
    References
    Impacted products
    Vendor Product Version
    BlackBerry Ltd QNX Hypervisor Affected: cpe:2.3:a:blackberry:qnx_hypervisor:8.0:*:*:*:*:*:*:* (cpe)
    Affected: cpe:2.3:a:blackberry:qnx_hypervisor:2.2:*:*:*:*:*:*:* (cpe)
    Affected: cpe:2.3:a:blackberry:qnx_hypervisor:2.0:*:*:*:*:*:*:* (cpe)
    Create a notification for this product.
    BlackBerry Ltd QNX Hypervisor for Safety Affected: cpe:2.3:a:blackberry:qnx_hypervisor_for_safety:8.0:*:*:*:*:*:*:* (cpe)
    Affected: cpe:2.3:a:blackberry:qnx_hypervisor_for_safety:2.2:*:*:*:*:*:*:* (cpe)
    Affected: cpe:2.3:a:blackberry:qnx_hypervisor_for_safety:2.0:*:*:*:*:*:*:* (cpe)
    Create a notification for this product.
    Date Public
    2026-11-10 17:15
    Show details on NVD website

    {
      "containers": {
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "QNX Hypervisor",
              "vendor": "BlackBerry Ltd",
              "versions": [
                {
                  "status": "affected",
                  "version": "cpe:2.3:a:blackberry:qnx_hypervisor:8.0:*:*:*:*:*:*:*",
                  "versionType": "cpe"
                },
                {
                  "status": "affected",
                  "version": "cpe:2.3:a:blackberry:qnx_hypervisor:2.2:*:*:*:*:*:*:*",
                  "versionType": "cpe"
                },
                {
                  "status": "affected",
                  "version": "cpe:2.3:a:blackberry:qnx_hypervisor:2.0:*:*:*:*:*:*:*",
                  "versionType": "cpe"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "QNX Hypervisor for Safety",
              "vendor": "BlackBerry Ltd",
              "versions": [
                {
                  "status": "affected",
                  "version": "cpe:2.3:a:blackberry:qnx_hypervisor_for_safety:8.0:*:*:*:*:*:*:*",
                  "versionType": "cpe"
                },
                {
                  "status": "affected",
                  "version": "cpe:2.3:a:blackberry:qnx_hypervisor_for_safety:2.2:*:*:*:*:*:*:*",
                  "versionType": "cpe"
                },
                {
                  "status": "affected",
                  "version": "cpe:2.3:a:blackberry:qnx_hypervisor_for_safety:2.0:*:*:*:*:*:*:*",
                  "versionType": "cpe"
                }
              ]
            }
          ],
          "datePublic": "2026-11-10T17:15:00.000Z",
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "Invalid Memory Access via the MSI-X table in QVM could allow an attacker in the guest to execute arbitrary code in the QVM to cause memory corruption, information disclosure or a crash of the QVM.\u0026nbsp;"
                }
              ],
              "value": "Invalid Memory Access via the MSI-X table in QVM could allow an attacker in the guest to execute arbitrary code in the QVM to cause memory corruption, information disclosure or a crash of the QVM."
            }
          ],
          "impacts": [
            {
              "capecId": "CAPEC-123",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-123 Buffer Manipulation"
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "HIGH",
                "attackVector": "LOCAL",
                "availabilityImpact": "LOW",
                "baseScore": 7.7,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-787",
                  "description": "CWE-787 Out-of-bounds write",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-11-10T19:28:51.340Z",
            "orgId": "dbe78b00-5e7b-4fda-8748-329789ecfc5c",
            "shortName": "blackberry"
          },
          "references": [
            {
              "url": "https://support.blackberry.com/pkb/s/article/141343"
            }
          ],
          "source": {
            "discovery": "UNKNOWN"
          },
          "title": "Vulnerabilities in the QNX Virtual Machine (QVM) affect QNX Hypervisor and QNX Hypervisor for Safety",
          "x_generator": {
            "engine": "Vulnogram 1.0.5"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "dbe78b00-5e7b-4fda-8748-329789ecfc5c",
        "assignerShortName": "blackberry",
        "cveId": "CVE-2026-50077",
        "datePublished": "2026-11-10T19:28:51.340Z",
        "dateReserved": "2026-06-03T14:17:51.177Z",
        "dateUpdated": "2026-11-10T19:28:51.340Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-50078 (GCVE-0-2026-50078)

    Vulnerability from cvelistv5 – Published: 2026-11-10 19:27 – Updated: 2026-11-10 19:27
    VLAI
    Title
    Vulnerabilities in the QNX Virtual Machine (QVM) affect QNX Hypervisor and QNX Hypervisor for Safety
    Summary
    Out-Of-Bounds Read in the MSI-X table in the QVM could allow an attacker in the guest to cause an information disclosure or a crash of the QVM.
    CWE
    Assigner
    References
    Impacted products
    Vendor Product Version
    BlackBerry Ltd QNX Hypervisor Affected: cpe:2.3:a:blackberry:qnx_hypervisor:8.0:*:*:*:*:*:*:* (cpe)
    Affected: cpe:2.3:a:blackberry:qnx_hypervisor:2.2:*:*:*:*:*:*:* (cpe)
    Affected: cpe:2.3:a:blackberry:qnx_hypervisor:2.0:*:*:*:*:*:*:* (cpe)
    Create a notification for this product.
    BlackBerry Ltd QNX Hypervisor for Safety Affected: cpe:2.3:a:blackberry:qnx_hypervisor_for_safety:8.0:*:*:*:*:*:*:* (cpe)
    Affected: cpe:2.3:a:blackberry:qnx_hypervisor_for_safety:2.2:*:*:*:*:*:*:* (cpe)
    Affected: cpe:2.3:a:blackberry:qnx_hypervisor_for_safety:2.0:*:*:*:*:*:*:* (cpe)
    Create a notification for this product.
    Date Public
    2026-11-10 17:15
    Show details on NVD website

    {
      "containers": {
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "QNX Hypervisor",
              "vendor": "BlackBerry Ltd",
              "versions": [
                {
                  "status": "affected",
                  "version": "cpe:2.3:a:blackberry:qnx_hypervisor:8.0:*:*:*:*:*:*:*",
                  "versionType": "cpe"
                },
                {
                  "status": "affected",
                  "version": "cpe:2.3:a:blackberry:qnx_hypervisor:2.2:*:*:*:*:*:*:*",
                  "versionType": "cpe"
                },
                {
                  "status": "affected",
                  "version": "cpe:2.3:a:blackberry:qnx_hypervisor:2.0:*:*:*:*:*:*:*",
                  "versionType": "cpe"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "QNX Hypervisor for Safety",
              "vendor": "BlackBerry Ltd",
              "versions": [
                {
                  "status": "affected",
                  "version": "cpe:2.3:a:blackberry:qnx_hypervisor_for_safety:8.0:*:*:*:*:*:*:*",
                  "versionType": "cpe"
                },
                {
                  "status": "affected",
                  "version": "cpe:2.3:a:blackberry:qnx_hypervisor_for_safety:2.2:*:*:*:*:*:*:*",
                  "versionType": "cpe"
                },
                {
                  "status": "affected",
                  "version": "cpe:2.3:a:blackberry:qnx_hypervisor_for_safety:2.0:*:*:*:*:*:*:*",
                  "versionType": "cpe"
                }
              ]
            }
          ],
          "datePublic": "2026-11-10T17:15:00.000Z",
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "Out-Of-Bounds Read in the MSI-X table in the QVM could allow an attacker in the guest to cause an information disclosure or a crash of the QVM.\u0026nbsp;"
                }
              ],
              "value": "Out-Of-Bounds Read in the MSI-X table in the QVM could allow an attacker in the guest to cause an information disclosure or a crash of the QVM."
            }
          ],
          "impacts": [
            {
              "capecId": "CAPEC-540",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-540 Overread Buffers"
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "LOW",
                "baseScore": 4.4,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-125",
                  "description": "CWE-125 Out-of-bounds read",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-11-10T19:27:47.321Z",
            "orgId": "dbe78b00-5e7b-4fda-8748-329789ecfc5c",
            "shortName": "blackberry"
          },
          "references": [
            {
              "url": "https://support.blackberry.com/pkb/s/article/141343"
            }
          ],
          "source": {
            "discovery": "UNKNOWN"
          },
          "title": "Vulnerabilities in the QNX Virtual Machine (QVM) affect QNX Hypervisor and QNX Hypervisor for Safety",
          "x_generator": {
            "engine": "Vulnogram 1.0.5"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "dbe78b00-5e7b-4fda-8748-329789ecfc5c",
        "assignerShortName": "blackberry",
        "cveId": "CVE-2026-50078",
        "datePublished": "2026-11-10T19:27:47.321Z",
        "dateReserved": "2026-06-03T14:17:51.177Z",
        "dateUpdated": "2026-11-10T19:27:47.321Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-50079 (GCVE-0-2026-50079)

    Vulnerability from cvelistv5 – Published: 2026-11-10 19:22 – Updated: 2026-11-10 19:22
    VLAI
    Title
    Vulnerabilities in the QNX Virtual Machine (QVM) affect QNX Hypervisor and QNX Hypervisor for Safety
    Summary
    Time-of-check Time-of-use (TOCTOU) Race Condition in the virtio network virtual device could allow an attacker in the guest to manipulate the virtual network device causing a crash of the QVM.
    CWE
    • CWE-367 - Time-of-check time-of-use (TOCTOU) race condition
    Assigner
    References
    Impacted products
    Vendor Product Version
    BlackBerry Ltd QNX Hypervisor Affected: cpe:2.3:a:blackberry:qnx_hypervisor:8.0:*:*:*:*:*:*:* (cpe)
    Affected: cpe:2.3:a:blackberry:qnx_hypervisor:2.2:*:*:*:*:*:*:* (cpe)
    Affected: cpe:2.3:a:blackberry:qnx_hypervisor:2.0:*:*:*:*:*:*:* (cpe)
    Create a notification for this product.
    BlackBerry Ltd QNX Hypervisor for Safety Affected: cpe:2.3:a:blackberry:qnx_hypervisor_for_safety:8.0:*:*:*:*:*:*:* (cpe)
    Affected: cpe:2.3:a:blackberry:qnx_hypervisor_for_safety:2.2:*:*:*:*:*:*:* (cpe)
    Affected: cpe:2.3:a:blackberry:qnx_hypervisor_for_safety:2.0:*:*:*:*:*:*:* (cpe)
    Create a notification for this product.
    Date Public
    2026-11-10 17:15
    Show details on NVD website

    {
      "containers": {
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "QNX Hypervisor",
              "vendor": "BlackBerry Ltd",
              "versions": [
                {
                  "status": "affected",
                  "version": "cpe:2.3:a:blackberry:qnx_hypervisor:8.0:*:*:*:*:*:*:*",
                  "versionType": "cpe"
                },
                {
                  "status": "affected",
                  "version": "cpe:2.3:a:blackberry:qnx_hypervisor:2.2:*:*:*:*:*:*:*",
                  "versionType": "cpe"
                },
                {
                  "status": "affected",
                  "version": "cpe:2.3:a:blackberry:qnx_hypervisor:2.0:*:*:*:*:*:*:*",
                  "versionType": "cpe"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "QNX Hypervisor for Safety",
              "vendor": "BlackBerry Ltd",
              "versions": [
                {
                  "status": "affected",
                  "version": "cpe:2.3:a:blackberry:qnx_hypervisor_for_safety:8.0:*:*:*:*:*:*:*",
                  "versionType": "cpe"
                },
                {
                  "status": "affected",
                  "version": "cpe:2.3:a:blackberry:qnx_hypervisor_for_safety:2.2:*:*:*:*:*:*:*",
                  "versionType": "cpe"
                },
                {
                  "status": "affected",
                  "version": "cpe:2.3:a:blackberry:qnx_hypervisor_for_safety:2.0:*:*:*:*:*:*:*",
                  "versionType": "cpe"
                }
              ]
            }
          ],
          "datePublic": "2026-11-10T17:15:00.000Z",
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "Time-of-check Time-of-use (TOCTOU) Race Condition in the virtio network virtual device could allow an attacker in the guest to manipulate the virtual network device causing a crash of the QVM.\u0026nbsp;"
                }
              ],
              "value": "Time-of-check Time-of-use (TOCTOU) Race Condition in the virtio network virtual device could allow an attacker in the guest to manipulate the virtual network device causing a crash of the QVM."
            }
          ],
          "impacts": [
            {
              "capecId": "CAPEC-29",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-29 Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions"
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "LOW",
                "baseScore": 3.3,
                "baseSeverity": "LOW",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-367",
                  "description": "CWE-367 Time-of-check time-of-use (TOCTOU) race condition",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-11-10T19:22:21.791Z",
            "orgId": "dbe78b00-5e7b-4fda-8748-329789ecfc5c",
            "shortName": "blackberry"
          },
          "references": [
            {
              "url": "https://support.blackberry.com/pkb/s/article/141343"
            }
          ],
          "source": {
            "discovery": "UNKNOWN"
          },
          "title": "Vulnerabilities in the QNX Virtual Machine (QVM) affect QNX Hypervisor and QNX Hypervisor for Safety",
          "x_generator": {
            "engine": "Vulnogram 1.0.5"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "dbe78b00-5e7b-4fda-8748-329789ecfc5c",
        "assignerShortName": "blackberry",
        "cveId": "CVE-2026-50079",
        "datePublished": "2026-11-10T19:22:21.791Z",
        "dateReserved": "2026-06-03T14:17:51.177Z",
        "dateUpdated": "2026-11-10T19:22:21.791Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-50080 (GCVE-0-2026-50080)

    Vulnerability from cvelistv5 – Published: 2026-11-10 19:17 – Updated: 2026-11-10 19:17
    VLAI
    Title
    Vulnerabilities in the QNX Virtual Machine (QVM) affect QNX Hypervisor and QNX Hypervisor for Safety
    Summary
    Stack-based Buffer Overflow in the ACPI event handler of the QVM could allow an attacker in a guest to crash the QVM by sending a crafted ACPI request.
    CWE
    • CWE-121 - Stack-based buffer overflow
    Assigner
    References
    Impacted products
    Vendor Product Version
    BlackBerry Ltd QNX Hypervisor Affected: cpe:2.3:a:blackberry:qnx_hypervisor:8.0:*:*:*:*:*:*:* (cpe)
    Affected: cpe:2.3:a:blackberry:qnx_hypervisor:2.2:*:*:*:*:*:*:* (cpe)
    Affected: cpe:2.3:a:blackberry:qnx_hypervisor:2.0:*:*:*:*:*:*:* (cpe)
    Create a notification for this product.
    BlackBerry Ltd QNX Hypervisor for Safety Affected: cpe:2.3:a:blackberry:qnx_hypervisor_for_safety:8.0:*:*:*:*:*:*:* (cpe)
    Affected: cpe:2.3:a:blackberry:qnx_hypervisor_for_safety:2.2:*:*:*:*:*:*:* (cpe)
    Affected: cpe:2.3:a:blackberry:qnx_hypervisor_for_safety:2.0:*:*:*:*:*:*:* (cpe)
    Create a notification for this product.
    Date Public
    2026-11-10 17:15
    Show details on NVD website

    {
      "containers": {
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "QNX Hypervisor",
              "vendor": "BlackBerry Ltd",
              "versions": [
                {
                  "status": "affected",
                  "version": "cpe:2.3:a:blackberry:qnx_hypervisor:8.0:*:*:*:*:*:*:*",
                  "versionType": "cpe"
                },
                {
                  "status": "affected",
                  "version": "cpe:2.3:a:blackberry:qnx_hypervisor:2.2:*:*:*:*:*:*:*",
                  "versionType": "cpe"
                },
                {
                  "status": "affected",
                  "version": "cpe:2.3:a:blackberry:qnx_hypervisor:2.0:*:*:*:*:*:*:*",
                  "versionType": "cpe"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "QNX Hypervisor for Safety",
              "vendor": "BlackBerry Ltd",
              "versions": [
                {
                  "status": "affected",
                  "version": "cpe:2.3:a:blackberry:qnx_hypervisor_for_safety:8.0:*:*:*:*:*:*:*",
                  "versionType": "cpe"
                },
                {
                  "status": "affected",
                  "version": "cpe:2.3:a:blackberry:qnx_hypervisor_for_safety:2.2:*:*:*:*:*:*:*",
                  "versionType": "cpe"
                },
                {
                  "status": "affected",
                  "version": "cpe:2.3:a:blackberry:qnx_hypervisor_for_safety:2.0:*:*:*:*:*:*:*",
                  "versionType": "cpe"
                }
              ]
            }
          ],
          "datePublic": "2026-11-10T17:15:00.000Z",
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "Stack-based Buffer Overflow in the ACPI event handler of the QVM could allow an attacker in a guest to crash the QVM by sending a crafted ACPI request.\u0026nbsp;"
                }
              ],
              "value": "Stack-based Buffer Overflow in the ACPI event handler of the QVM could allow an attacker in a guest to crash the QVM by sending a crafted ACPI request."
            }
          ],
          "impacts": [
            {
              "capecId": "CAPEC-100",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-100 Overflow Buffers"
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "LOW",
                "baseScore": 3.3,
                "baseSeverity": "LOW",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-121",
                  "description": "CWE-121 Stack-based buffer overflow",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-11-10T19:17:47.043Z",
            "orgId": "dbe78b00-5e7b-4fda-8748-329789ecfc5c",
            "shortName": "blackberry"
          },
          "references": [
            {
              "url": "https://support.blackberry.com/pkb/s/article/141343"
            }
          ],
          "source": {
            "discovery": "UNKNOWN"
          },
          "title": "Vulnerabilities in the QNX Virtual Machine (QVM) affect QNX Hypervisor and QNX Hypervisor for Safety",
          "x_generator": {
            "engine": "Vulnogram 1.0.5"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "dbe78b00-5e7b-4fda-8748-329789ecfc5c",
        "assignerShortName": "blackberry",
        "cveId": "CVE-2026-50080",
        "datePublished": "2026-11-10T19:17:47.043Z",
        "dateReserved": "2026-06-03T14:17:51.177Z",
        "dateUpdated": "2026-11-10T19:17:47.043Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }