Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-40275 (GCVE-0-2026-40275)

Vulnerability from cvelistv5 – Published: 2026-11-10 18:58 – Updated: 2026-11-10 18:58

Title

Vulnerabilities in the QNX Neutrino kernel affect QNX Software Development Platform and QNX OS for Safety

Summary

Heap-based Buffer Overflow in the DCMD_PROC_EVENT handler of the procnto could allow an attacker with local access to cause an information disclosure, data tampering or a crash of the QNX Neutrino kernel.

Severity

8.4 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-122 - Heap-based buffer overflow

Assigner

blackberry CNA

References

1 reference

URL	Tags
https://support.blackberry.com/pkb/s/article/141342

Impacted products

3 products

Vendor	Product	Version
BlackBerry Ltd	QNX Software Development Platform	Affected: cpe:2.3:a:blackberry:qnx_software_development_platform:7.1:::::::* (cpe) Affected: cpe:2.3:a:blackberry:qnx_software_development_platform:7.0:::::::* (cpe)
BlackBerry Ltd	QNX OS for Safety	Affected: cpe:2.3:o:blackberry:qnx_os_for_safety:2.2:9:::::: (cpe) Affected: cpe:2.3:o:blackberry:qnx_os_for_safety:2.1:6:::::: (cpe) Affected: cpe:2.3:o:blackberry:qnx_os_for_safety:2.0:4:::::: (cpe)
BlackBerry Ltd	QNX OS for Medical	Affected: cpe:2.3:o:blackberry:qnx_os_for_medical:2.0:3:::::: (cpe)

Date Public

2026-11-10 17:15

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "QNX Software Development Platform",
          "vendor": "BlackBerry Ltd",
          "versions": [
            {
              "status": "affected",
              "version": "cpe:2.3:a:blackberry:qnx_software_development_platform:7.1:*:*:*:*:*:*:*",
              "versionType": "cpe"
            },
            {
              "status": "affected",
              "version": "cpe:2.3:a:blackberry:qnx_software_development_platform:7.0:*:*:*:*:*:*:*",
              "versionType": "cpe"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "QNX OS for Safety",
          "vendor": "BlackBerry Ltd",
          "versions": [
            {
              "status": "affected",
              "version": "cpe:2.3:o:blackberry:qnx_os_for_safety:2.2:9:*:*:*:*:*:*",
              "versionType": "cpe"
            },
            {
              "status": "affected",
              "version": "cpe:2.3:o:blackberry:qnx_os_for_safety:2.1:6:*:*:*:*:*:*",
              "versionType": "cpe"
            },
            {
              "status": "affected",
              "version": "cpe:2.3:o:blackberry:qnx_os_for_safety:2.0:4:*:*:*:*:*:*",
              "versionType": "cpe"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "QNX OS for Medical",
          "vendor": "BlackBerry Ltd",
          "versions": [
            {
              "status": "affected",
              "version": "cpe:2.3:o:blackberry:qnx_os_for_medical:2.0:3:*:*:*:*:*:*",
              "versionType": "cpe"
            }
          ]
        }
      ],
      "datePublic": "2026-11-10T17:15:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Heap-based Buffer Overflow in the DCMD_PROC_EVENT handler of the procnto could allow an attacker with local access to cause an information disclosure, data tampering or a crash of the QNX Neutrino kernel.\u0026nbsp;"
            }
          ],
          "value": "Heap-based Buffer Overflow in the DCMD_PROC_EVENT handler of the procnto could allow an attacker with local access to cause an information disclosure, data tampering or a crash of the QNX Neutrino kernel."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-100",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-100 Overflow Buffers"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-122",
              "description": "CWE-122 Heap-based buffer overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-10T18:58:50.235Z",
        "orgId": "dbe78b00-5e7b-4fda-8748-329789ecfc5c",
        "shortName": "blackberry"
      },
      "references": [
        {
          "url": "https://support.blackberry.com/pkb/s/article/141342"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Vulnerabilities in the QNX Neutrino kernel affect QNX Software Development Platform and QNX OS for Safety",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dbe78b00-5e7b-4fda-8748-329789ecfc5c",
    "assignerShortName": "blackberry",
    "cveId": "CVE-2026-40275",
    "datePublished": "2026-11-10T18:58:50.235Z",
    "dateReserved": "2026-04-10T17:41:10.441Z",
    "dateUpdated": "2026-11-10T18:58:50.235Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-54436 (GCVE-0-2026-54436)

Vulnerability from cvelistv5 – Published: 2026-11-10 18:42 – Updated: 2026-11-10 18:45

Title

Vulnerabilities in the QNX io-char library Impacts QNX Software Development Platform

Summary

Heap-based Buffer Overflow in the io-char library's DCMD_CHR_WAITINFO devctl() handler could allow an attacker with local access to cause data tampering, arbitrary code execution, or a crash in the Character I/O device driver.

Severity

7.4 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-122 - Heap-based buffer overflow

Assigner

blackberry CNA

References

1 reference

URL	Tags
https://support.blackberry.com/pkb/s/article/141341

Impacted products

1 product

Vendor	Product	Version
BlackBerry Ltd	QNX Software Development Platform	Affected: cpe:2.3:a:blackberry:qnx_software_development_platform:8.0:::::::* (cpe) Affected: cpe:2.3:a:blackberry:qnx_software_development_platform:7.1:::::::* (cpe) Affected: cpe:2.3:a:blackberry:qnx_software_development_platform:7.0:::::::* (cpe)

Date Public

2026-11-10 17:15

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "QNX Software Development Platform",
          "vendor": "BlackBerry Ltd",
          "versions": [
            {
              "status": "affected",
              "version": "cpe:2.3:a:blackberry:qnx_software_development_platform:8.0:*:*:*:*:*:*:*",
              "versionType": "cpe"
            },
            {
              "status": "affected",
              "version": "cpe:2.3:a:blackberry:qnx_software_development_platform:7.1:*:*:*:*:*:*:*",
              "versionType": "cpe"
            },
            {
              "status": "affected",
              "version": "cpe:2.3:a:blackberry:qnx_software_development_platform:7.0:*:*:*:*:*:*:*",
              "versionType": "cpe"
            }
          ]
        }
      ],
      "datePublic": "2026-11-10T17:15:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Heap-based Buffer\nOverflow in the io-char library\u0027s DCMD_CHR_WAITINFO devctl() handler could\nallow an attacker with local access to cause data tampering, arbitrary code\nexecution, or a crash in the Character I/O device driver."
            }
          ],
          "value": "Heap-based Buffer\nOverflow in the io-char library\u0027s DCMD_CHR_WAITINFO devctl() handler could\nallow an attacker with local access to cause data tampering, arbitrary code\nexecution, or a crash in the Character I/O device driver."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-100",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-100 Overflow Buffers"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-122",
              "description": "CWE-122 Heap-based buffer overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-10T18:45:12.077Z",
        "orgId": "dbe78b00-5e7b-4fda-8748-329789ecfc5c",
        "shortName": "blackberry"
      },
      "references": [
        {
          "url": "https://support.blackberry.com/pkb/s/article/141341"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Vulnerabilities in the QNX io-char library Impacts QNX Software Development Platform",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dbe78b00-5e7b-4fda-8748-329789ecfc5c",
    "assignerShortName": "blackberry",
    "cveId": "CVE-2026-54436",
    "datePublished": "2026-11-10T18:42:08.067Z",
    "dateReserved": "2026-06-15T15:26:06.017Z",
    "dateUpdated": "2026-11-10T18:45:12.077Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-54437 (GCVE-0-2026-54437)

Vulnerability from cvelistv5 – Published: 2026-11-10 18:39 – Updated: 2026-11-10 18:47

Title

Vulnerabilities in the QNX io-char library Impacts QNX Software Development Platform

Summary

Improper Input Validation in the io-char library's DCMD_CHR_TCINJECTC devctl() handler could allow an attacker with local access to cause data tampering in the memory input buffer of the Character I/O device driver.

Severity

6.2 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CWE

CWE-1287 - Improper validation of specified type of input

Assigner

blackberry CNA

References

1 reference

URL	Tags
https://support.blackberry.com/pkb/s/article/141341

Impacted products

1 product

Vendor	Product	Version
BlackBerry Ltd	QNX Software Development Platform	Affected: cpe:2.3:a:blackberry:qnx_software_development_platform:8.0:::::::* (cpe) Affected: cpe:2.3:a:blackberry:qnx_software_development_platform:7.1:::::::* (cpe) Affected: cpe:2.3:a:blackberry:qnx_software_development_platform:7.0:::::::* (cpe)

Date Public

2026-11-10 17:15

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "QNX Software Development Platform",
          "vendor": "BlackBerry Ltd",
          "versions": [
            {
              "status": "affected",
              "version": "cpe:2.3:a:blackberry:qnx_software_development_platform:8.0:*:*:*:*:*:*:*",
              "versionType": "cpe"
            },
            {
              "status": "affected",
              "version": "cpe:2.3:a:blackberry:qnx_software_development_platform:7.1:*:*:*:*:*:*:*",
              "versionType": "cpe"
            },
            {
              "status": "affected",
              "version": "cpe:2.3:a:blackberry:qnx_software_development_platform:7.0:*:*:*:*:*:*:*",
              "versionType": "cpe"
            }
          ]
        }
      ],
      "datePublic": "2026-11-10T17:15:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper Input Validation in the io-char library\u0027s\nDCMD_CHR_TCINJECTC devctl() handler could allow an attacker with local access\nto cause data tampering in the memory input buffer of the Character I/O device\ndriver."
            }
          ],
          "value": "Improper Input Validation in the io-char library\u0027s\nDCMD_CHR_TCINJECTC devctl() handler could allow an attacker with local access\nto cause data tampering in the memory input buffer of the Character I/O device\ndriver."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-123",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-123 Buffer Manipulation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 6.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1287",
              "description": "CWE-1287 Improper validation of specified type of input",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-10T18:47:06.886Z",
        "orgId": "dbe78b00-5e7b-4fda-8748-329789ecfc5c",
        "shortName": "blackberry"
      },
      "references": [
        {
          "url": "https://support.blackberry.com/pkb/s/article/141341"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Vulnerabilities in the QNX io-char library Impacts QNX Software Development Platform",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dbe78b00-5e7b-4fda-8748-329789ecfc5c",
    "assignerShortName": "blackberry",
    "cveId": "CVE-2026-54437",
    "datePublished": "2026-11-10T18:39:05.986Z",
    "dateReserved": "2026-06-15T15:26:06.017Z",
    "dateUpdated": "2026-11-10T18:47:06.886Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-40272 (GCVE-0-2026-40272)

Vulnerability from cvelistv5 – Published: 2026-07-29 17:58 – Updated: 2026-07-29 18:08

Title

Vulnerability in the QNX libtraceparser Impacts QNX Software Development Platform

Summary

Improper Input Validation in the decode() function of the traceparser library could allow an attacker with a corrupted kernel trace event log (.kev) file, to execute arbitrary code or cause a crash in processes that use libtraceparser in QNX hosts or targets.

Severity

7 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-29 18:08 UTC

CWE

CWE-1284 - Improper validation of specified quantity in input

Assigner

blackberry CNA

References

1 reference

URL	Tags
https://support.blackberry.com/pkb/s/article/141229	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
BlackBerry Ltd	QNX Software Development Platform	Affected: 8.0 (custom) Affected: cpe:2.3:a:blackberry:qnx_software_development_platform:8.0:::::::* (cpe) Affected: 7.1 (custom) Affected: cpe:2.3:a:blackberry:qnx_software_development_platform:7.1:::::::* (cpe) Affected: 7.0 (custom) Affected: cpe:2.3:a:blackberry:qnx_software_development_platform:7.0:::::::* (cpe)

Date Public

2026-07-29 17:21

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-40272",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-29T18:08:02.435661Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-29T18:08:13.992Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "QNX Software Development Platform",
          "vendor": "BlackBerry Ltd",
          "versions": [
            {
              "status": "affected",
              "version": "8.0",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "cpe:2.3:a:blackberry:qnx_software_development_platform:8.0:*:*:*:*:*:*:*",
              "versionType": "cpe"
            },
            {
              "status": "affected",
              "version": "7.1",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "cpe:2.3:a:blackberry:qnx_software_development_platform:7.1:*:*:*:*:*:*:*",
              "versionType": "cpe"
            },
            {
              "status": "affected",
              "version": "7.0",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "cpe:2.3:a:blackberry:qnx_software_development_platform:7.0:*:*:*:*:*:*:*",
              "versionType": "cpe"
            }
          ]
        }
      ],
      "datePublic": "2026-07-29T17:21:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper Input Validation in the decode() function of the traceparser library could allow an attacker with a corrupted kernel trace event log (.kev) file, to execute arbitrary code or cause a crash in processes that use libtraceparser in QNX hosts or targets."
            }
          ],
          "value": "Improper Input Validation in the decode() function of the traceparser library could allow an attacker with a corrupted kernel trace event log (.kev) file, to execute arbitrary code or cause a crash in processes that use libtraceparser in QNX hosts or targets."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-263",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-263 Force Use of Corrupted Files"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1284",
              "description": "CWE-1284 Improper validation of specified quantity in input",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-29T17:58:27.761Z",
        "orgId": "dbe78b00-5e7b-4fda-8748-329789ecfc5c",
        "shortName": "blackberry"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://support.blackberry.com/pkb/s/article/141229"
        }
      ],
      "source": {
        "advisory": "QNX-2026-003",
        "discovery": "UNKNOWN"
      },
      "title": "Vulnerability in the QNX libtraceparser Impacts QNX Software Development Platform",
      "x_generator": {
        "engine": "Vulnogram 1.0.4"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dbe78b00-5e7b-4fda-8748-329789ecfc5c",
    "assignerShortName": "blackberry",
    "cveId": "CVE-2026-40272",
    "datePublished": "2026-07-29T17:58:27.761Z",
    "dateReserved": "2026-04-10T17:41:10.441Z",
    "dateUpdated": "2026-07-29T18:08:13.992Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-4018 (GCVE-0-2026-4018)

Vulnerability from cvelistv5 – Published: 2026-07-14 17:34 – Updated: 2026-07-15 14:01

Title

TOCTOU race condition in the QNX Neutrino kernel impacts versions of the QNX Software Development Platform and QNX OS for Safety

Summary

TOCTOU Race Condition in specific trace commands of the TraceEvent() system call could allow an attacker with local access and with the PROCMGR_AID_TRACE ability, to cause information disclosure, data tampering or a crash of the QNX Neutrino kernel.

Severity

6.4 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-15 14:00 UTC

CWE

CWE-367 - Time-of-check time-of-use (TOCTOU) race condition

Assigner

blackberry CNA

References

1 reference

URL	Tags
https://support.blackberry.com/pkb/s/article/141213

Impacted products

3 products

Vendor	Product	Version
BlackBerry Ltd	QNX Software Development Platform	Affected: 7.1 Affected: cpe:2.3:a:blackberry:qnx_software_development_platform:7.1:::::::* (cpe) Affected: 7.0 Affected: cpe:2.3:a:blackberry:qnx_software_development_platform:7.0:::::::* (cpe)
BlackBerry Ltd	QNX OS for Safety	Affected: 2.2.8 and earlier Affected: cpe:2.3:o:blackberry:qnx_os_for_safety:2.2:8:::::: (cpe) Affected: 2.1.5 and earlier Affected: cpe:2.3:o:blackberry:qnx_os_for_safety:2.1:5:::::: (cpe) Affected: 2.0.3 and earlier Affected: cpe:2.3:o:blackberry:qnx_os_for_safety:2.0:3:::::: (cpe)
BlackBerry Ltd.	QNX OS for Medical	Affected: 2.0.2 and earlier Affected: cpe:2.3:o:blackberry:qnx_os_for_medical:2.0:2:::::: (cpe)

Date Public

2026-07-14 15:20

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-4018",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-15T14:00:49.532095Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-15T14:01:13.318Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "QNX Software Development Platform",
          "vendor": "BlackBerry Ltd",
          "versions": [
            {
              "status": "affected",
              "version": "7.1"
            },
            {
              "status": "affected",
              "version": "cpe:2.3:a:blackberry:qnx_software_development_platform:7.1:*:*:*:*:*:*:*",
              "versionType": "cpe"
            },
            {
              "status": "affected",
              "version": "7.0"
            },
            {
              "status": "affected",
              "version": "cpe:2.3:a:blackberry:qnx_software_development_platform:7.0:*:*:*:*:*:*:*",
              "versionType": "cpe"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "QNX OS for Safety",
          "vendor": "BlackBerry Ltd",
          "versions": [
            {
              "status": "affected",
              "version": "2.2.8 and earlier"
            },
            {
              "status": "affected",
              "version": "cpe:2.3:o:blackberry:qnx_os_for_safety:2.2:8:*:*:*:*:*:*",
              "versionType": "cpe"
            },
            {
              "status": "affected",
              "version": "2.1.5 and earlier"
            },
            {
              "status": "affected",
              "version": "cpe:2.3:o:blackberry:qnx_os_for_safety:2.1:5:*:*:*:*:*:*",
              "versionType": "cpe"
            },
            {
              "status": "affected",
              "version": "2.0.3 and earlier"
            },
            {
              "status": "affected",
              "version": "cpe:2.3:o:blackberry:qnx_os_for_safety:2.0:3:*:*:*:*:*:*",
              "versionType": "cpe"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "QNX OS for Medical",
          "vendor": "BlackBerry Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "2.0.2 and earlier"
            },
            {
              "status": "affected",
              "version": "cpe:2.3:o:blackberry:qnx_os_for_medical:2.0:2:*:*:*:*:*:*",
              "versionType": "cpe"
            }
          ]
        }
      ],
      "datePublic": "2026-07-14T15:20:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "TOCTOU Race Condition in specific trace commands of the TraceEvent() system call could allow an attacker with local access and with the PROCMGR_AID_TRACE ability, to cause information disclosure, data tampering or a crash of the QNX Neutrino kernel."
            }
          ],
          "value": "TOCTOU Race Condition in specific trace commands of the TraceEvent() system call could allow an attacker with local access and with the PROCMGR_AID_TRACE ability, to cause information disclosure, data tampering or a crash of the QNX Neutrino kernel."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-29",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-29 Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-367",
              "description": "CWE-367 Time-of-check time-of-use (TOCTOU) race condition",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-14T17:34:01.952Z",
        "orgId": "dbe78b00-5e7b-4fda-8748-329789ecfc5c",
        "shortName": "blackberry"
      },
      "references": [
        {
          "url": "https://support.blackberry.com/pkb/s/article/141213"
        }
      ],
      "source": {
        "advisory": "https://support.blackberry.com/pkb/s/article/141213",
        "discovery": "UNKNOWN"
      },
      "title": "TOCTOU race condition in the QNX Neutrino kernel impacts versions of the QNX Software Development Platform and QNX OS for Safety",
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dbe78b00-5e7b-4fda-8748-329789ecfc5c",
    "assignerShortName": "blackberry",
    "cveId": "CVE-2026-4018",
    "datePublished": "2026-07-14T17:34:01.952Z",
    "dateReserved": "2026-03-11T19:24:46.531Z",
    "dateUpdated": "2026-07-15T14:01:13.318Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-4017 (GCVE-0-2026-4017)

Vulnerability from cvelistv5 – Published: 2026-07-14 17:25 – Updated: 2026-07-14 23:36

Title

Buffer overflow in the QNX Neutrino kernel impacts versions of the QNX Software Development Platform and QNX OS for Safety

Summary

Buffer Overflow in the entry handler of the TraceEvent() system call could allow an attacker with local access to cause information disclosure, data tampering or a crash of the QNX Neutrino kernel.

Severity

7.4 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-14 23:36 UTC

CWE

CWE-121 - Stack-based buffer overflow

Assigner

blackberry CNA

References

1 reference

URL	Tags
https://support.blackberry.com/pkb/s/article/141213

Impacted products

3 products

Vendor	Product	Version
BlackBerry Ltd	QNX Software Development Platform	Affected: 7.1 Affected: cpe:2.3:a:blackberry:qnx_software_development_platform:7.1:::::::* (cpe) Affected: 7.0 Affected: cpe:2.3:a:blackberry:qnx_software_development_platform:7.0:::::::* (cpe)
BlackBerry Ltd	QNX OS for Safety	Affected: 2.2.8 and earlier Affected: cpe:2.3:o:blackberry:qnx_os_for_safety:2.2:8:::::: (cpe) Affected: 2.1.5 and earlier Affected: cpe:2.3:o:blackberry:qnx_os_for_safety:2.1:5:::::: (cpe) Affected: 2.0.3 and earlier Affected: cpe:2.3:o:blackberry:qnx_os_for_safety:2.0:3:::::: (cpe)
BlackBerry Ltd.	QNX OS for Medical	Affected: 2.0.2 and earlier Affected: cpe:2.3:o:blackberry:qnx_os_for_medical:2.0:2:::::: (cpe)

Date Public

2026-07-14 15:15

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-4017",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-14T23:36:16.979515Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-14T23:36:28.181Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "QNX Software Development Platform",
          "vendor": "BlackBerry Ltd",
          "versions": [
            {
              "status": "affected",
              "version": "7.1"
            },
            {
              "status": "affected",
              "version": "cpe:2.3:a:blackberry:qnx_software_development_platform:7.1:*:*:*:*:*:*:*",
              "versionType": "cpe"
            },
            {
              "status": "affected",
              "version": "7.0"
            },
            {
              "status": "affected",
              "version": "cpe:2.3:a:blackberry:qnx_software_development_platform:7.0:*:*:*:*:*:*:*",
              "versionType": "cpe"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "QNX OS for Safety",
          "vendor": "BlackBerry Ltd",
          "versions": [
            {
              "status": "affected",
              "version": "2.2.8 and earlier"
            },
            {
              "status": "affected",
              "version": "cpe:2.3:o:blackberry:qnx_os_for_safety:2.2:8:*:*:*:*:*:*",
              "versionType": "cpe"
            },
            {
              "status": "affected",
              "version": "2.1.5 and earlier"
            },
            {
              "status": "affected",
              "version": "cpe:2.3:o:blackberry:qnx_os_for_safety:2.1:5:*:*:*:*:*:*",
              "versionType": "cpe"
            },
            {
              "status": "affected",
              "version": "2.0.3 and earlier"
            },
            {
              "status": "affected",
              "version": "cpe:2.3:o:blackberry:qnx_os_for_safety:2.0:3:*:*:*:*:*:*",
              "versionType": "cpe"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "QNX OS for Medical",
          "vendor": "BlackBerry Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "2.0.2 and earlier"
            },
            {
              "status": "affected",
              "version": "cpe:2.3:o:blackberry:qnx_os_for_medical:2.0:2:*:*:*:*:*:*",
              "versionType": "cpe"
            }
          ]
        }
      ],
      "datePublic": "2026-07-14T15:15:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Buffer Overflow in the entry handler of the TraceEvent() system call could allow an attacker with local access to cause information disclosure, data tampering or a crash of the QNX Neutrino kernel.\u0026nbsp;"
            }
          ],
          "value": "Buffer Overflow in the entry handler of the TraceEvent() system call could allow an attacker with local access to cause information disclosure, data tampering or a crash of the QNX Neutrino kernel."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-100",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-100 Overflow Buffers"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-121",
              "description": "CWE-121 Stack-based buffer overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-14T17:25:13.128Z",
        "orgId": "dbe78b00-5e7b-4fda-8748-329789ecfc5c",
        "shortName": "blackberry"
      },
      "references": [
        {
          "url": "https://support.blackberry.com/pkb/s/article/141213"
        }
      ],
      "source": {
        "advisory": "https://support.blackberry.com/pkb/s/article/141213",
        "discovery": "UNKNOWN"
      },
      "title": "Buffer overflow in the QNX Neutrino kernel impacts versions of the QNX Software Development Platform and QNX OS for Safety",
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dbe78b00-5e7b-4fda-8748-329789ecfc5c",
    "assignerShortName": "blackberry",
    "cveId": "CVE-2026-4017",
    "datePublished": "2026-07-14T17:25:13.128Z",
    "dateReserved": "2026-03-11T19:20:13.205Z",
    "dateUpdated": "2026-07-14T23:36:28.181Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-0515 (GCVE-0-2026-0515)

Vulnerability from cvelistv5 – Published: 2026-07-14 17:13 – Updated: 2026-07-14 23:35

Title

Insufficient parameter validation in the QNX Neutrino kernel impacts versions of the QNX Software Development Platform and QNX OS for Safety

Summary

Insufficient Parameter Validation in the SchedGet() system call could allow an attacker with local access to cause a crash of the QNX Neutrino kernel.

Severity

6.2 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-14 23:35 UTC

CWE

CWE-233 - Improper handling of parameters

Assigner

blackberry CNA

References

1 reference

URL	Tags
https://support.blackberry.com/pkb/s/article/141213

Impacted products

3 products

Vendor	Product	Version
BlackBerry Ltd	QNX Software Development Platform	Affected: 7.1 Affected: cpe:2.3:a:blackberry:qnx_software_development_platform:7.1:::::::* (cpe) Affected: 7.0 Affected: cpe:2.3:a:blackberry:qnx_software_development_platform:7.0:::::::*
BlackBerry Ltd	QNX OS for Safety	Affected: 2.2.8 and earlier Affected: cpe:2.3:o:blackberry:qnx_os_for_safety:2.2:8:::::: (cpe) Affected: 2.1.5 and earlier Affected: cpe:2.3:o:blackberry:qnx_os_for_safety:2.1:5:::::: (cpe) Affected: 2.0.3 and earlier Affected: cpe:2.3:o:blackberry:qnx_os_for_safety:2.0:3:::::: (cpe)
BlackBerry Ltd.	QNX OS for Medical	Affected: 2.0.2 and earlier Affected: cpe:2.3:o:blackberry:qnx_os_for_medical:2.0:2:::::: (cpe)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-0515",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-14T23:35:18.765970Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-14T23:35:27.900Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "QNX Software Development Platform",
          "vendor": "BlackBerry Ltd",
          "versions": [
            {
              "status": "affected",
              "version": "7.1"
            },
            {
              "status": "affected",
              "version": "cpe:2.3:a:blackberry:qnx_software_development_platform:7.1:*:*:*:*:*:*:*",
              "versionType": "cpe"
            },
            {
              "status": "affected",
              "version": "7.0"
            },
            {
              "status": "affected",
              "version": "cpe:2.3:a:blackberry:qnx_software_development_platform:7.0:*:*:*:*:*:*:*"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "QNX OS for Safety",
          "vendor": "BlackBerry Ltd",
          "versions": [
            {
              "status": "affected",
              "version": "2.2.8 and earlier"
            },
            {
              "status": "affected",
              "version": "cpe:2.3:o:blackberry:qnx_os_for_safety:2.2:8:*:*:*:*:*:*",
              "versionType": "cpe"
            },
            {
              "status": "affected",
              "version": "2.1.5 and earlier"
            },
            {
              "status": "affected",
              "version": "cpe:2.3:o:blackberry:qnx_os_for_safety:2.1:5:*:*:*:*:*:*",
              "versionType": "cpe"
            },
            {
              "status": "affected",
              "version": "2.0.3 and earlier"
            },
            {
              "status": "affected",
              "version": "cpe:2.3:o:blackberry:qnx_os_for_safety:2.0:3:*:*:*:*:*:*",
              "versionType": "cpe"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "QNX OS for Medical",
          "vendor": "BlackBerry Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "2.0.2 and earlier"
            },
            {
              "status": "affected",
              "version": "cpe:2.3:o:blackberry:qnx_os_for_medical:2.0:2:*:*:*:*:*:*",
              "versionType": "cpe"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Insufficient Parameter Validation in the SchedGet() system call could allow an attacker with local access to cause a crash of the QNX Neutrino kernel."
            }
          ],
          "value": "Insufficient Parameter Validation in the SchedGet() system call could allow an attacker with local access to cause a crash of the QNX Neutrino kernel."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-153",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-153 Input Data Manipulation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-233",
              "description": "CWE-233 Improper handling of parameters",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-14T17:13:07.258Z",
        "orgId": "dbe78b00-5e7b-4fda-8748-329789ecfc5c",
        "shortName": "blackberry"
      },
      "references": [
        {
          "url": "https://support.blackberry.com/pkb/s/article/141213"
        }
      ],
      "source": {
        "advisory": "https://support.blackberry.com/pkb/s/article/141213",
        "discovery": "UNKNOWN"
      },
      "title": "Insufficient parameter validation in the QNX Neutrino kernel impacts versions of the QNX Software Development Platform and QNX OS for Safety",
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dbe78b00-5e7b-4fda-8748-329789ecfc5c",
    "assignerShortName": "blackberry",
    "cveId": "CVE-2026-0515",
    "datePublished": "2026-07-14T17:13:07.258Z",
    "dateReserved": "2025-12-10T15:04:59.507Z",
    "dateUpdated": "2026-07-14T23:35:27.900Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-8090 (GCVE-0-2025-8090)

Vulnerability from cvelistv5 – Published: 2026-01-13 16:36 – Updated: 2026-01-13 21:41

Title

Vulnerability in the QNX Neutrino Kernel impacts the QNX Software Development Platform and QNX OS for Safety

Summary

Null pointer dereference in the MsgRegisterEvent() system call could allow an attacker with local access and code execution abilities to crash the QNX Neutrino kernel.

Severity

6.2 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-01-13 21:41 UTC

CWE

CWE-476 - NULL Pointer Dereference

Assigner

blackberry CNA

References

1 reference

URL	Tags
https://support.blackberry.com/pkb/s/article/141027	vendor-advisory

Impacted products

3 products

Vendor	Product	Version
BlackBerry Ltd	QNX Software Development Platform	Affected: 7.1 and 7.0 (custom) Affected: cpe:2.3:a:blackberry:qnx_software_development_platform:7.1:::::::* (cpe) Affected: cpe:2.3:a:blackberry:qnx_software_development_platform:7.0:::::::* (cpe)
BlackBerry Ltd	QNX OS for Safety	Affected: 2.2.7 and earlier (custom) Affected: cpe:2.3:o:blackberry:qnx_os_for_safety:2.2:7:::::: (cpe) Affected: 2.1.4 and earlier (custom) Affected: cpe:2.3:o:blackberry:qnx_os_for_safety:2.1:4:::::: (cpe) Affected: 2.0.2 and earlier (custom) Affected: cpe:2.3:o:blackberry:qnx_os_for_safety:2.0:2:::::: (cpe)
BlackBerry Ltd.	QNX OS for Medical	Affected: 2.0.1 and earlier (custom) Affected: cpe:2.3:o:blackberry:qnx_os_for_medical:2.0:1:::::: (cpe)

Date Public

2026-01-13 16:25

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-8090",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-13T21:41:44.974623Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-13T21:41:51.831Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "QNX Software Development Platform",
          "vendor": "BlackBerry Ltd",
          "versions": [
            {
              "status": "affected",
              "version": "7.1 and 7.0",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "cpe:2.3:a:blackberry:qnx_software_development_platform:7.1:*:*:*:*:*:*:*",
              "versionType": "cpe"
            },
            {
              "status": "affected",
              "version": "cpe:2.3:a:blackberry:qnx_software_development_platform:7.0:*:*:*:*:*:*:*",
              "versionType": "cpe"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "QNX OS for Safety",
          "vendor": "BlackBerry Ltd",
          "versions": [
            {
              "status": "affected",
              "version": "2.2.7 and earlier",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "cpe:2.3:o:blackberry:qnx_os_for_safety:2.2:7:*:*:*:*:*:*",
              "versionType": "cpe"
            },
            {
              "status": "affected",
              "version": "2.1.4 and earlier",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "cpe:2.3:o:blackberry:qnx_os_for_safety:2.1:4:*:*:*:*:*:*",
              "versionType": "cpe"
            },
            {
              "status": "affected",
              "version": "2.0.2 and earlier",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "cpe:2.3:o:blackberry:qnx_os_for_safety:2.0:2:*:*:*:*:*:*",
              "versionType": "cpe"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "QNX OS for Medical",
          "vendor": "BlackBerry Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "2.0.1 and earlier",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "cpe:2.3:o:blackberry:qnx_os_for_medical:2.0:1:*:*:*:*:*:*",
              "versionType": "cpe"
            }
          ]
        }
      ],
      "datePublic": "2026-01-13T16:25:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Null pointer dereference in the MsgRegisterEvent() system call could allow\u0026nbsp;an attacker with local access and code execution abilities to crash the\u0026nbsp;QNX Neutrino kernel."
            }
          ],
          "value": "Null pointer dereference in the MsgRegisterEvent() system call could allow\u00a0an attacker with local access and code execution abilities to crash the\u00a0QNX Neutrino kernel."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-129",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-129 Pointer Manipulation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-476",
              "description": "CWE-476 NULL Pointer Dereference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-13T18:57:38.781Z",
        "orgId": "dbe78b00-5e7b-4fda-8748-329789ecfc5c",
        "shortName": "blackberry"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://support.blackberry.com/pkb/s/article/141027"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Vulnerability in the QNX Neutrino Kernel impacts the QNX Software Development Platform and QNX OS for Safety",
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dbe78b00-5e7b-4fda-8748-329789ecfc5c",
    "assignerShortName": "blackberry",
    "cveId": "CVE-2025-8090",
    "datePublished": "2026-01-13T16:36:21.061Z",
    "dateReserved": "2025-07-23T15:38:00.519Z",
    "dateUpdated": "2026-01-13T21:41:51.831Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Find a vulnerability

Search criteria

8 vulnerabilities found for QNX Software Development Platform by BlackBerry Ltd

CVE-2026-40275 (GCVE-0-2026-40275)

CVE-2026-54436 (GCVE-0-2026-54436)

CVE-2026-54437 (GCVE-0-2026-54437)

CVE-2026-40272 (GCVE-0-2026-40272)

CVE-2026-4018 (GCVE-0-2026-4018)

CVE-2026-4017 (GCVE-0-2026-4017)

CVE-2026-0515 (GCVE-0-2026-0515)

CVE-2025-8090 (GCVE-0-2025-8090)