Search
Find a vulnerability
Search criteria
7 vulnerabilities found for QNX OS for Safety by BlackBerry Ltd
CVE-2026-40273 (GCVE-0-2026-40273)
Vulnerability from cvelistv5 – Published: 2026-11-10 19:06 – Updated: 2026-11-10 19:06
VLAI
EPSS
VEX
Title
Vulnerabilities in the QNX Neutrino kernel affect QNX Software Development Platform and QNX OS for Safety
Summary
Improper Input Validation in a procnto message handler could allow an attacker with local access to send a crafted message which can cause an information disclosure in the QNX Neutrino kernel
Severity
4 (Medium)
CWE
- CWE-1287 - Improper validation of specified type of input
Assigner
blackberry
CNA
References
1 reference
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| BlackBerry Ltd | QNX Software Development Platform (SDP) |
Affected:
cpe:2.3:a:blackberry:qnx_software_development_platform:7.1:*:*:*:*:*:*:*
(cpe)
Affected: cpe:2.3:a:blackberry:qnx_software_development_platform:7.0:*:*:*:*:*:*:* (cpe) |
|
| BlackBerry Ltd | QNX OS for Safety |
Affected:
cpe:2.3:o:blackberry:qnx_os_for_safety:2.2:9:*:*:*:*:*:*
(cpe)
Affected: cpe:2.3:o:blackberry:qnx_os_for_safety:2.1:6:*:*:*:*:*:* (cpe) Affected: cpe:2.3:o:blackberry:qnx_os_for_safety:2.0:4:*:*:*:*:*:* (cpe) |
|
| BlackBerry Ltd | QNX OS for Medical |
Affected:
cpe:2.3:o:blackberry:qnx_os_for_medical:2.0:3:*:*:*:*:*:*
(cpe)
|
Date Public
2026-11-10 17:15
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "QNX Software Development Platform (SDP)",
"vendor": "BlackBerry Ltd",
"versions": [
{
"status": "affected",
"version": "cpe:2.3:a:blackberry:qnx_software_development_platform:7.1:*:*:*:*:*:*:*",
"versionType": "cpe"
},
{
"status": "affected",
"version": "cpe:2.3:a:blackberry:qnx_software_development_platform:7.0:*:*:*:*:*:*:*",
"versionType": "cpe"
}
]
},
{
"defaultStatus": "unaffected",
"product": "QNX OS for Safety",
"vendor": "BlackBerry Ltd",
"versions": [
{
"status": "affected",
"version": "cpe:2.3:o:blackberry:qnx_os_for_safety:2.2:9:*:*:*:*:*:*",
"versionType": "cpe"
},
{
"status": "affected",
"version": "cpe:2.3:o:blackberry:qnx_os_for_safety:2.1:6:*:*:*:*:*:*",
"versionType": "cpe"
},
{
"status": "affected",
"version": "cpe:2.3:o:blackberry:qnx_os_for_safety:2.0:4:*:*:*:*:*:*",
"versionType": "cpe"
}
]
},
{
"defaultStatus": "unaffected",
"product": "QNX OS for Medical",
"vendor": "BlackBerry Ltd",
"versions": [
{
"status": "affected",
"version": "cpe:2.3:o:blackberry:qnx_os_for_medical:2.0:3:*:*:*:*:*:*",
"versionType": "cpe"
}
]
}
],
"datePublic": "2026-11-10T17:15:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Input Validation in a procnto message handler could allow an attacker with local access to send a crafted message which can cause an information disclosure in the QNX Neutrino kernel\u0026nbsp;"
}
],
"value": "Improper Input Validation in a procnto message handler could allow an attacker with local access to send a crafted message which can cause an information disclosure in the QNX Neutrino kernel"
}
],
"impacts": [
{
"capecId": "CAPEC-153",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-153 Input Data Manipulation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1287",
"description": "CWE-1287 Improper validation of specified type of input",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T19:06:57.717Z",
"orgId": "dbe78b00-5e7b-4fda-8748-329789ecfc5c",
"shortName": "blackberry"
},
"references": [
{
"url": "https://support.blackberry.com/pkb/s/article/141342"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Vulnerabilities in the QNX Neutrino kernel affect QNX Software Development Platform and QNX OS for Safety",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "dbe78b00-5e7b-4fda-8748-329789ecfc5c",
"assignerShortName": "blackberry",
"cveId": "CVE-2026-40273",
"datePublished": "2026-11-10T19:06:57.717Z",
"dateReserved": "2026-04-10T17:41:10.441Z",
"dateUpdated": "2026-11-10T19:06:57.717Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-40274 (GCVE-0-2026-40274)
Vulnerability from cvelistv5 – Published: 2026-11-10 19:03 – Updated: 2026-11-10 19:03
VLAI
EPSS
VEX
Title
Vulnerabilities in the QNX Neutrino kernel affect QNX Software Development Platform and QNX OS for Safety
Summary
Invalid Pointer Reference in the TimerSettime() system call could allow an attacker with local access to arm a crafted timer event which can cause an information disclosure in the QNX Neutrino kernel.
Severity
4 (Medium)
CWE
- CWE-822 - Untrusted pointer dereference
Assigner
blackberry
CNA
References
1 reference
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| BlackBerry Ltd | QNX Software Development Platform (SDP) |
Affected:
cpe:2.3:a:blackberry:qnx_software_development_platform:7.1:*:*:*:*:*:*:*
(cpe)
Affected: cpe:2.3:a:blackberry:qnx_software_development_platform:7.0:*:*:*:*:*:*:* (cpe) |
|
| BlackBerry Ltd | QNX OS for Safety |
Affected:
cpe:2.3:o:blackberry:qnx_os_for_safety:2.2:9:*:*:*:*:*:*
(cpe)
Affected: cpe:2.3:o:blackberry:qnx_os_for_safety:2.1:6:*:*:*:*:*:* (cpe) Affected: cpe:2.3:o:blackberry:qnx_os_for_safety:2.0:4:*:*:*:*:*:* (cpe) |
|
| BlackBerry Ltd | QNX OS for Medical |
Affected:
cpe:2.3:o:blackberry:qnx_os_for_medical:2.0:3:*:*:*:*:*:*
(cpe)
|
Date Public
2026-11-10 17:15
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "QNX Software Development Platform (SDP)",
"vendor": "BlackBerry Ltd",
"versions": [
{
"status": "affected",
"version": "cpe:2.3:a:blackberry:qnx_software_development_platform:7.1:*:*:*:*:*:*:*",
"versionType": "cpe"
},
{
"status": "affected",
"version": "cpe:2.3:a:blackberry:qnx_software_development_platform:7.0:*:*:*:*:*:*:*",
"versionType": "cpe"
}
]
},
{
"defaultStatus": "unaffected",
"product": "QNX OS for Safety",
"vendor": "BlackBerry Ltd",
"versions": [
{
"status": "affected",
"version": "cpe:2.3:o:blackberry:qnx_os_for_safety:2.2:9:*:*:*:*:*:*",
"versionType": "cpe"
},
{
"status": "affected",
"version": "cpe:2.3:o:blackberry:qnx_os_for_safety:2.1:6:*:*:*:*:*:*",
"versionType": "cpe"
},
{
"status": "affected",
"version": "cpe:2.3:o:blackberry:qnx_os_for_safety:2.0:4:*:*:*:*:*:*",
"versionType": "cpe"
}
]
},
{
"defaultStatus": "unaffected",
"product": "QNX OS for Medical",
"vendor": "BlackBerry Ltd",
"versions": [
{
"status": "affected",
"version": "cpe:2.3:o:blackberry:qnx_os_for_medical:2.0:3:*:*:*:*:*:*",
"versionType": "cpe"
}
]
}
],
"datePublic": "2026-11-10T17:15:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Invalid Pointer Reference in the TimerSettime() system call could allow an attacker with local access to arm a crafted timer event which can cause an information disclosure in the QNX Neutrino kernel.\u0026nbsp;"
}
],
"value": "Invalid Pointer Reference in the TimerSettime() system call could allow an attacker with local access to arm a crafted timer event which can cause an information disclosure in the QNX Neutrino kernel."
}
],
"impacts": [
{
"capecId": "CAPEC-129",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-129 Pointer Manipulation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-822",
"description": "CWE-822 Untrusted pointer dereference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T19:03:42.088Z",
"orgId": "dbe78b00-5e7b-4fda-8748-329789ecfc5c",
"shortName": "blackberry"
},
"references": [
{
"url": "https://support.blackberry.com/pkb/s/article/141342"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Vulnerabilities in the QNX Neutrino kernel affect QNX Software Development Platform and QNX OS for Safety",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "dbe78b00-5e7b-4fda-8748-329789ecfc5c",
"assignerShortName": "blackberry",
"cveId": "CVE-2026-40274",
"datePublished": "2026-11-10T19:03:42.088Z",
"dateReserved": "2026-04-10T17:41:10.441Z",
"dateUpdated": "2026-11-10T19:03:42.088Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-40275 (GCVE-0-2026-40275)
Vulnerability from cvelistv5 – Published: 2026-11-10 18:58 – Updated: 2026-11-10 18:58
VLAI
EPSS
VEX
Title
Vulnerabilities in the QNX Neutrino kernel affect QNX Software Development Platform and QNX OS for Safety
Summary
Heap-based Buffer Overflow in the DCMD_PROC_EVENT handler of the procnto could allow an attacker with local access to cause an information disclosure, data tampering or a crash of the QNX Neutrino kernel.
Severity
8.4 (High)
CWE
- CWE-122 - Heap-based buffer overflow
Assigner
blackberry
CNA
References
1 reference
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| BlackBerry Ltd | QNX Software Development Platform |
Affected:
cpe:2.3:a:blackberry:qnx_software_development_platform:7.1:*:*:*:*:*:*:*
(cpe)
Affected: cpe:2.3:a:blackberry:qnx_software_development_platform:7.0:*:*:*:*:*:*:* (cpe) |
|
| BlackBerry Ltd | QNX OS for Safety |
Affected:
cpe:2.3:o:blackberry:qnx_os_for_safety:2.2:9:*:*:*:*:*:*
(cpe)
Affected: cpe:2.3:o:blackberry:qnx_os_for_safety:2.1:6:*:*:*:*:*:* (cpe) Affected: cpe:2.3:o:blackberry:qnx_os_for_safety:2.0:4:*:*:*:*:*:* (cpe) |
|
| BlackBerry Ltd | QNX OS for Medical |
Affected:
cpe:2.3:o:blackberry:qnx_os_for_medical:2.0:3:*:*:*:*:*:*
(cpe)
|
Date Public
2026-11-10 17:15
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "QNX Software Development Platform",
"vendor": "BlackBerry Ltd",
"versions": [
{
"status": "affected",
"version": "cpe:2.3:a:blackberry:qnx_software_development_platform:7.1:*:*:*:*:*:*:*",
"versionType": "cpe"
},
{
"status": "affected",
"version": "cpe:2.3:a:blackberry:qnx_software_development_platform:7.0:*:*:*:*:*:*:*",
"versionType": "cpe"
}
]
},
{
"defaultStatus": "unaffected",
"product": "QNX OS for Safety",
"vendor": "BlackBerry Ltd",
"versions": [
{
"status": "affected",
"version": "cpe:2.3:o:blackberry:qnx_os_for_safety:2.2:9:*:*:*:*:*:*",
"versionType": "cpe"
},
{
"status": "affected",
"version": "cpe:2.3:o:blackberry:qnx_os_for_safety:2.1:6:*:*:*:*:*:*",
"versionType": "cpe"
},
{
"status": "affected",
"version": "cpe:2.3:o:blackberry:qnx_os_for_safety:2.0:4:*:*:*:*:*:*",
"versionType": "cpe"
}
]
},
{
"defaultStatus": "unaffected",
"product": "QNX OS for Medical",
"vendor": "BlackBerry Ltd",
"versions": [
{
"status": "affected",
"version": "cpe:2.3:o:blackberry:qnx_os_for_medical:2.0:3:*:*:*:*:*:*",
"versionType": "cpe"
}
]
}
],
"datePublic": "2026-11-10T17:15:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Heap-based Buffer Overflow in the DCMD_PROC_EVENT handler of the procnto could allow an attacker with local access to cause an information disclosure, data tampering or a crash of the QNX Neutrino kernel.\u0026nbsp;"
}
],
"value": "Heap-based Buffer Overflow in the DCMD_PROC_EVENT handler of the procnto could allow an attacker with local access to cause an information disclosure, data tampering or a crash of the QNX Neutrino kernel."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "CWE-122 Heap-based buffer overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T18:58:50.235Z",
"orgId": "dbe78b00-5e7b-4fda-8748-329789ecfc5c",
"shortName": "blackberry"
},
"references": [
{
"url": "https://support.blackberry.com/pkb/s/article/141342"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Vulnerabilities in the QNX Neutrino kernel affect QNX Software Development Platform and QNX OS for Safety",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "dbe78b00-5e7b-4fda-8748-329789ecfc5c",
"assignerShortName": "blackberry",
"cveId": "CVE-2026-40275",
"datePublished": "2026-11-10T18:58:50.235Z",
"dateReserved": "2026-04-10T17:41:10.441Z",
"dateUpdated": "2026-11-10T18:58:50.235Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-4018 (GCVE-0-2026-4018)
Vulnerability from cvelistv5 – Published: 2026-07-14 17:34 – Updated: 2026-07-15 14:01
VLAI
EPSS
VEX
Title
TOCTOU race condition in the QNX Neutrino kernel impacts versions of the QNX Software Development Platform and QNX OS for Safety
Summary
TOCTOU Race Condition in specific trace commands of the TraceEvent() system call could allow an attacker with local access and with the PROCMGR_AID_TRACE ability, to cause information disclosure, data tampering or a crash of the QNX Neutrino kernel.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-15 14:00 UTC
CWE
- CWE-367 - Time-of-check time-of-use (TOCTOU) race condition
Assigner
blackberry
CNA
References
1 reference
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| BlackBerry Ltd | QNX Software Development Platform |
Affected:
7.1
Affected: cpe:2.3:a:blackberry:qnx_software_development_platform:7.1:*:*:*:*:*:*:* (cpe) Affected: 7.0 Affected: cpe:2.3:a:blackberry:qnx_software_development_platform:7.0:*:*:*:*:*:*:* (cpe) |
|
| BlackBerry Ltd | QNX OS for Safety |
Affected:
2.2.8 and earlier
Affected: cpe:2.3:o:blackberry:qnx_os_for_safety:2.2:8:*:*:*:*:*:* (cpe) Affected: 2.1.5 and earlier Affected: cpe:2.3:o:blackberry:qnx_os_for_safety:2.1:5:*:*:*:*:*:* (cpe) Affected: 2.0.3 and earlier Affected: cpe:2.3:o:blackberry:qnx_os_for_safety:2.0:3:*:*:*:*:*:* (cpe) |
|
| BlackBerry Ltd. | QNX OS for Medical |
Affected:
2.0.2 and earlier
Affected: cpe:2.3:o:blackberry:qnx_os_for_medical:2.0:2:*:*:*:*:*:* (cpe) |
Date Public
2026-07-14 15:20
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-4018",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-15T14:00:49.532095Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-15T14:01:13.318Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "QNX Software Development Platform",
"vendor": "BlackBerry Ltd",
"versions": [
{
"status": "affected",
"version": "7.1"
},
{
"status": "affected",
"version": "cpe:2.3:a:blackberry:qnx_software_development_platform:7.1:*:*:*:*:*:*:*",
"versionType": "cpe"
},
{
"status": "affected",
"version": "7.0"
},
{
"status": "affected",
"version": "cpe:2.3:a:blackberry:qnx_software_development_platform:7.0:*:*:*:*:*:*:*",
"versionType": "cpe"
}
]
},
{
"defaultStatus": "unaffected",
"product": "QNX OS for Safety",
"vendor": "BlackBerry Ltd",
"versions": [
{
"status": "affected",
"version": "2.2.8 and earlier"
},
{
"status": "affected",
"version": "cpe:2.3:o:blackberry:qnx_os_for_safety:2.2:8:*:*:*:*:*:*",
"versionType": "cpe"
},
{
"status": "affected",
"version": "2.1.5 and earlier"
},
{
"status": "affected",
"version": "cpe:2.3:o:blackberry:qnx_os_for_safety:2.1:5:*:*:*:*:*:*",
"versionType": "cpe"
},
{
"status": "affected",
"version": "2.0.3 and earlier"
},
{
"status": "affected",
"version": "cpe:2.3:o:blackberry:qnx_os_for_safety:2.0:3:*:*:*:*:*:*",
"versionType": "cpe"
}
]
},
{
"defaultStatus": "unaffected",
"product": "QNX OS for Medical",
"vendor": "BlackBerry Ltd.",
"versions": [
{
"status": "affected",
"version": "2.0.2 and earlier"
},
{
"status": "affected",
"version": "cpe:2.3:o:blackberry:qnx_os_for_medical:2.0:2:*:*:*:*:*:*",
"versionType": "cpe"
}
]
}
],
"datePublic": "2026-07-14T15:20:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "TOCTOU Race Condition in specific trace commands of the TraceEvent() system call could allow an attacker with local access and with the PROCMGR_AID_TRACE ability, to cause information disclosure, data tampering or a crash of the QNX Neutrino kernel."
}
],
"value": "TOCTOU Race Condition in specific trace commands of the TraceEvent() system call could allow an attacker with local access and with the PROCMGR_AID_TRACE ability, to cause information disclosure, data tampering or a crash of the QNX Neutrino kernel."
}
],
"impacts": [
{
"capecId": "CAPEC-29",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-29 Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-367",
"description": "CWE-367 Time-of-check time-of-use (TOCTOU) race condition",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T17:34:01.952Z",
"orgId": "dbe78b00-5e7b-4fda-8748-329789ecfc5c",
"shortName": "blackberry"
},
"references": [
{
"url": "https://support.blackberry.com/pkb/s/article/141213"
}
],
"source": {
"advisory": "https://support.blackberry.com/pkb/s/article/141213",
"discovery": "UNKNOWN"
},
"title": "TOCTOU race condition in the QNX Neutrino kernel impacts versions of the QNX Software Development Platform and QNX OS for Safety",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "dbe78b00-5e7b-4fda-8748-329789ecfc5c",
"assignerShortName": "blackberry",
"cveId": "CVE-2026-4018",
"datePublished": "2026-07-14T17:34:01.952Z",
"dateReserved": "2026-03-11T19:24:46.531Z",
"dateUpdated": "2026-07-15T14:01:13.318Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-4017 (GCVE-0-2026-4017)
Vulnerability from cvelistv5 – Published: 2026-07-14 17:25 – Updated: 2026-07-14 23:36
VLAI
EPSS
VEX
Title
Buffer overflow in the QNX Neutrino kernel impacts versions of the QNX Software Development Platform and QNX OS for Safety
Summary
Buffer Overflow in the entry handler of the TraceEvent() system call could allow an attacker with local access to cause information disclosure, data tampering or a crash of the QNX Neutrino kernel.
Severity
7.4 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-14 23:36 UTC
CWE
- CWE-121 - Stack-based buffer overflow
Assigner
blackberry
CNA
References
1 reference
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| BlackBerry Ltd | QNX Software Development Platform |
Affected:
7.1
Affected: cpe:2.3:a:blackberry:qnx_software_development_platform:7.1:*:*:*:*:*:*:* (cpe) Affected: 7.0 Affected: cpe:2.3:a:blackberry:qnx_software_development_platform:7.0:*:*:*:*:*:*:* (cpe) |
|
| BlackBerry Ltd | QNX OS for Safety |
Affected:
2.2.8 and earlier
Affected: cpe:2.3:o:blackberry:qnx_os_for_safety:2.2:8:*:*:*:*:*:* (cpe) Affected: 2.1.5 and earlier Affected: cpe:2.3:o:blackberry:qnx_os_for_safety:2.1:5:*:*:*:*:*:* (cpe) Affected: 2.0.3 and earlier Affected: cpe:2.3:o:blackberry:qnx_os_for_safety:2.0:3:*:*:*:*:*:* (cpe) |
|
| BlackBerry Ltd. | QNX OS for Medical |
Affected:
2.0.2 and earlier
Affected: cpe:2.3:o:blackberry:qnx_os_for_medical:2.0:2:*:*:*:*:*:* (cpe) |
Date Public
2026-07-14 15:15
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-4017",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-14T23:36:16.979515Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T23:36:28.181Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "QNX Software Development Platform",
"vendor": "BlackBerry Ltd",
"versions": [
{
"status": "affected",
"version": "7.1"
},
{
"status": "affected",
"version": "cpe:2.3:a:blackberry:qnx_software_development_platform:7.1:*:*:*:*:*:*:*",
"versionType": "cpe"
},
{
"status": "affected",
"version": "7.0"
},
{
"status": "affected",
"version": "cpe:2.3:a:blackberry:qnx_software_development_platform:7.0:*:*:*:*:*:*:*",
"versionType": "cpe"
}
]
},
{
"defaultStatus": "unaffected",
"product": "QNX OS for Safety",
"vendor": "BlackBerry Ltd",
"versions": [
{
"status": "affected",
"version": "2.2.8 and earlier"
},
{
"status": "affected",
"version": "cpe:2.3:o:blackberry:qnx_os_for_safety:2.2:8:*:*:*:*:*:*",
"versionType": "cpe"
},
{
"status": "affected",
"version": "2.1.5 and earlier"
},
{
"status": "affected",
"version": "cpe:2.3:o:blackberry:qnx_os_for_safety:2.1:5:*:*:*:*:*:*",
"versionType": "cpe"
},
{
"status": "affected",
"version": "2.0.3 and earlier"
},
{
"status": "affected",
"version": "cpe:2.3:o:blackberry:qnx_os_for_safety:2.0:3:*:*:*:*:*:*",
"versionType": "cpe"
}
]
},
{
"defaultStatus": "unaffected",
"product": "QNX OS for Medical",
"vendor": "BlackBerry Ltd.",
"versions": [
{
"status": "affected",
"version": "2.0.2 and earlier"
},
{
"status": "affected",
"version": "cpe:2.3:o:blackberry:qnx_os_for_medical:2.0:2:*:*:*:*:*:*",
"versionType": "cpe"
}
]
}
],
"datePublic": "2026-07-14T15:15:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Buffer Overflow in the entry handler of the TraceEvent() system call could allow an attacker with local access to cause information disclosure, data tampering or a crash of the QNX Neutrino kernel.\u0026nbsp;"
}
],
"value": "Buffer Overflow in the entry handler of the TraceEvent() system call could allow an attacker with local access to cause information disclosure, data tampering or a crash of the QNX Neutrino kernel."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121 Stack-based buffer overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T17:25:13.128Z",
"orgId": "dbe78b00-5e7b-4fda-8748-329789ecfc5c",
"shortName": "blackberry"
},
"references": [
{
"url": "https://support.blackberry.com/pkb/s/article/141213"
}
],
"source": {
"advisory": "https://support.blackberry.com/pkb/s/article/141213",
"discovery": "UNKNOWN"
},
"title": "Buffer overflow in the QNX Neutrino kernel impacts versions of the QNX Software Development Platform and QNX OS for Safety",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "dbe78b00-5e7b-4fda-8748-329789ecfc5c",
"assignerShortName": "blackberry",
"cveId": "CVE-2026-4017",
"datePublished": "2026-07-14T17:25:13.128Z",
"dateReserved": "2026-03-11T19:20:13.205Z",
"dateUpdated": "2026-07-14T23:36:28.181Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-0515 (GCVE-0-2026-0515)
Vulnerability from cvelistv5 – Published: 2026-07-14 17:13 – Updated: 2026-07-14 23:35
VLAI
EPSS
VEX
Title
Insufficient parameter validation in the QNX Neutrino kernel impacts versions of the QNX Software Development Platform and QNX OS for Safety
Summary
Insufficient Parameter Validation in the SchedGet() system call could allow an attacker with local access to cause a crash of the QNX Neutrino kernel.
Severity
6.2 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-14 23:35 UTC
CWE
- CWE-233 - Improper handling of parameters
Assigner
blackberry
CNA
References
1 reference
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| BlackBerry Ltd | QNX Software Development Platform |
Affected:
7.1
Affected: cpe:2.3:a:blackberry:qnx_software_development_platform:7.1:*:*:*:*:*:*:* (cpe) Affected: 7.0 Affected: cpe:2.3:a:blackberry:qnx_software_development_platform:7.0:*:*:*:*:*:*:* |
|
| BlackBerry Ltd | QNX OS for Safety |
Affected:
2.2.8 and earlier
Affected: cpe:2.3:o:blackberry:qnx_os_for_safety:2.2:8:*:*:*:*:*:* (cpe) Affected: 2.1.5 and earlier Affected: cpe:2.3:o:blackberry:qnx_os_for_safety:2.1:5:*:*:*:*:*:* (cpe) Affected: 2.0.3 and earlier Affected: cpe:2.3:o:blackberry:qnx_os_for_safety:2.0:3:*:*:*:*:*:* (cpe) |
|
| BlackBerry Ltd. | QNX OS for Medical |
Affected:
2.0.2 and earlier
Affected: cpe:2.3:o:blackberry:qnx_os_for_medical:2.0:2:*:*:*:*:*:* (cpe) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-0515",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-14T23:35:18.765970Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T23:35:27.900Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "QNX Software Development Platform",
"vendor": "BlackBerry Ltd",
"versions": [
{
"status": "affected",
"version": "7.1"
},
{
"status": "affected",
"version": "cpe:2.3:a:blackberry:qnx_software_development_platform:7.1:*:*:*:*:*:*:*",
"versionType": "cpe"
},
{
"status": "affected",
"version": "7.0"
},
{
"status": "affected",
"version": "cpe:2.3:a:blackberry:qnx_software_development_platform:7.0:*:*:*:*:*:*:*"
}
]
},
{
"defaultStatus": "unaffected",
"product": "QNX OS for Safety",
"vendor": "BlackBerry Ltd",
"versions": [
{
"status": "affected",
"version": "2.2.8 and earlier"
},
{
"status": "affected",
"version": "cpe:2.3:o:blackberry:qnx_os_for_safety:2.2:8:*:*:*:*:*:*",
"versionType": "cpe"
},
{
"status": "affected",
"version": "2.1.5 and earlier"
},
{
"status": "affected",
"version": "cpe:2.3:o:blackberry:qnx_os_for_safety:2.1:5:*:*:*:*:*:*",
"versionType": "cpe"
},
{
"status": "affected",
"version": "2.0.3 and earlier"
},
{
"status": "affected",
"version": "cpe:2.3:o:blackberry:qnx_os_for_safety:2.0:3:*:*:*:*:*:*",
"versionType": "cpe"
}
]
},
{
"defaultStatus": "unaffected",
"product": "QNX OS for Medical",
"vendor": "BlackBerry Ltd.",
"versions": [
{
"status": "affected",
"version": "2.0.2 and earlier"
},
{
"status": "affected",
"version": "cpe:2.3:o:blackberry:qnx_os_for_medical:2.0:2:*:*:*:*:*:*",
"versionType": "cpe"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Insufficient Parameter Validation in the SchedGet() system call could allow an attacker with local access to cause a crash of the QNX Neutrino kernel."
}
],
"value": "Insufficient Parameter Validation in the SchedGet() system call could allow an attacker with local access to cause a crash of the QNX Neutrino kernel."
}
],
"impacts": [
{
"capecId": "CAPEC-153",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-153 Input Data Manipulation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-233",
"description": "CWE-233 Improper handling of parameters",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T17:13:07.258Z",
"orgId": "dbe78b00-5e7b-4fda-8748-329789ecfc5c",
"shortName": "blackberry"
},
"references": [
{
"url": "https://support.blackberry.com/pkb/s/article/141213"
}
],
"source": {
"advisory": "https://support.blackberry.com/pkb/s/article/141213",
"discovery": "UNKNOWN"
},
"title": "Insufficient parameter validation in the QNX Neutrino kernel impacts versions of the QNX Software Development Platform and QNX OS for Safety",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "dbe78b00-5e7b-4fda-8748-329789ecfc5c",
"assignerShortName": "blackberry",
"cveId": "CVE-2026-0515",
"datePublished": "2026-07-14T17:13:07.258Z",
"dateReserved": "2025-12-10T15:04:59.507Z",
"dateUpdated": "2026-07-14T23:35:27.900Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-8090 (GCVE-0-2025-8090)
Vulnerability from cvelistv5 – Published: 2026-01-13 16:36 – Updated: 2026-01-13 21:41
VLAI
EPSS
VEX
Title
Vulnerability in the QNX Neutrino Kernel impacts the QNX Software Development Platform and QNX OS for Safety
Summary
Null pointer dereference in the MsgRegisterEvent() system call could allow an attacker with local access and code execution abilities to crash the QNX Neutrino kernel.
Severity
6.2 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-01-13 21:41 UTC
CWE
- CWE-476 - NULL Pointer Dereference
Assigner
blackberry
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://support.blackberry.com/pkb/s/article/141027 | vendor-advisory |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| BlackBerry Ltd | QNX Software Development Platform |
Affected:
7.1 and 7.0
(custom)
Affected: cpe:2.3:a:blackberry:qnx_software_development_platform:7.1:*:*:*:*:*:*:* (cpe) Affected: cpe:2.3:a:blackberry:qnx_software_development_platform:7.0:*:*:*:*:*:*:* (cpe) |
|
| BlackBerry Ltd | QNX OS for Safety |
Affected:
2.2.7 and earlier
(custom)
Affected: cpe:2.3:o:blackberry:qnx_os_for_safety:2.2:7:*:*:*:*:*:* (cpe) Affected: 2.1.4 and earlier (custom) Affected: cpe:2.3:o:blackberry:qnx_os_for_safety:2.1:4:*:*:*:*:*:* (cpe) Affected: 2.0.2 and earlier (custom) Affected: cpe:2.3:o:blackberry:qnx_os_for_safety:2.0:2:*:*:*:*:*:* (cpe) |
|
| BlackBerry Ltd. | QNX OS for Medical |
Affected:
2.0.1 and earlier
(custom)
Affected: cpe:2.3:o:blackberry:qnx_os_for_medical:2.0:1:*:*:*:*:*:* (cpe) |
Date Public
2026-01-13 16:25
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-8090",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-13T21:41:44.974623Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-01-13T21:41:51.831Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "QNX Software Development Platform",
"vendor": "BlackBerry Ltd",
"versions": [
{
"status": "affected",
"version": "7.1 and 7.0",
"versionType": "custom"
},
{
"status": "affected",
"version": "cpe:2.3:a:blackberry:qnx_software_development_platform:7.1:*:*:*:*:*:*:*",
"versionType": "cpe"
},
{
"status": "affected",
"version": "cpe:2.3:a:blackberry:qnx_software_development_platform:7.0:*:*:*:*:*:*:*",
"versionType": "cpe"
}
]
},
{
"defaultStatus": "unaffected",
"product": "QNX OS for Safety",
"vendor": "BlackBerry Ltd",
"versions": [
{
"status": "affected",
"version": "2.2.7 and earlier",
"versionType": "custom"
},
{
"status": "affected",
"version": "cpe:2.3:o:blackberry:qnx_os_for_safety:2.2:7:*:*:*:*:*:*",
"versionType": "cpe"
},
{
"status": "affected",
"version": "2.1.4 and earlier",
"versionType": "custom"
},
{
"status": "affected",
"version": "cpe:2.3:o:blackberry:qnx_os_for_safety:2.1:4:*:*:*:*:*:*",
"versionType": "cpe"
},
{
"status": "affected",
"version": "2.0.2 and earlier",
"versionType": "custom"
},
{
"status": "affected",
"version": "cpe:2.3:o:blackberry:qnx_os_for_safety:2.0:2:*:*:*:*:*:*",
"versionType": "cpe"
}
]
},
{
"defaultStatus": "unaffected",
"product": "QNX OS for Medical",
"vendor": "BlackBerry Ltd.",
"versions": [
{
"status": "affected",
"version": "2.0.1 and earlier",
"versionType": "custom"
},
{
"status": "affected",
"version": "cpe:2.3:o:blackberry:qnx_os_for_medical:2.0:1:*:*:*:*:*:*",
"versionType": "cpe"
}
]
}
],
"datePublic": "2026-01-13T16:25:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Null pointer dereference in the MsgRegisterEvent() system call could allow\u0026nbsp;an attacker with local access and code execution abilities to crash the\u0026nbsp;QNX Neutrino kernel."
}
],
"value": "Null pointer dereference in the MsgRegisterEvent() system call could allow\u00a0an attacker with local access and code execution abilities to crash the\u00a0QNX Neutrino kernel."
}
],
"impacts": [
{
"capecId": "CAPEC-129",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-129 Pointer Manipulation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-476",
"description": "CWE-476 NULL Pointer Dereference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-01-13T18:57:38.781Z",
"orgId": "dbe78b00-5e7b-4fda-8748-329789ecfc5c",
"shortName": "blackberry"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://support.blackberry.com/pkb/s/article/141027"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Vulnerability in the QNX Neutrino Kernel impacts the QNX Software Development Platform and QNX OS for Safety",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "dbe78b00-5e7b-4fda-8748-329789ecfc5c",
"assignerShortName": "blackberry",
"cveId": "CVE-2025-8090",
"datePublished": "2026-01-13T16:36:21.061Z",
"dateReserved": "2025-07-23T15:38:00.519Z",
"dateUpdated": "2026-01-13T21:41:51.831Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}