Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-40273 (GCVE-0-2026-40273)

Vulnerability from cvelistv5 – Published: 2026-11-10 19:06 – Updated: 2026-11-10 19:06

Title

Vulnerabilities in the QNX Neutrino kernel affect QNX Software Development Platform and QNX OS for Safety

Summary

Improper Input Validation in a procnto message handler could allow an attacker with local access to send a crafted message which can cause an information disclosure in the QNX Neutrino kernel

Severity

4 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CWE

CWE-1287 - Improper validation of specified type of input

Assigner

blackberry CNA

References

1 reference

URL	Tags
https://support.blackberry.com/pkb/s/article/141342

Impacted products

3 products

Vendor	Product	Version
BlackBerry Ltd	QNX Software Development Platform (SDP)	Affected: cpe:2.3:a:blackberry:qnx_software_development_platform:7.1:::::::* (cpe) Affected: cpe:2.3:a:blackberry:qnx_software_development_platform:7.0:::::::* (cpe)
BlackBerry Ltd	QNX OS for Safety	Affected: cpe:2.3:o:blackberry:qnx_os_for_safety:2.2:9:::::: (cpe) Affected: cpe:2.3:o:blackberry:qnx_os_for_safety:2.1:6:::::: (cpe) Affected: cpe:2.3:o:blackberry:qnx_os_for_safety:2.0:4:::::: (cpe)
BlackBerry Ltd	QNX OS for Medical	Affected: cpe:2.3:o:blackberry:qnx_os_for_medical:2.0:3:::::: (cpe)

Date Public

2026-11-10 17:15

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "QNX Software Development Platform (SDP)",
          "vendor": "BlackBerry Ltd",
          "versions": [
            {
              "status": "affected",
              "version": "cpe:2.3:a:blackberry:qnx_software_development_platform:7.1:*:*:*:*:*:*:*",
              "versionType": "cpe"
            },
            {
              "status": "affected",
              "version": "cpe:2.3:a:blackberry:qnx_software_development_platform:7.0:*:*:*:*:*:*:*",
              "versionType": "cpe"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "QNX OS for Safety",
          "vendor": "BlackBerry Ltd",
          "versions": [
            {
              "status": "affected",
              "version": "cpe:2.3:o:blackberry:qnx_os_for_safety:2.2:9:*:*:*:*:*:*",
              "versionType": "cpe"
            },
            {
              "status": "affected",
              "version": "cpe:2.3:o:blackberry:qnx_os_for_safety:2.1:6:*:*:*:*:*:*",
              "versionType": "cpe"
            },
            {
              "status": "affected",
              "version": "cpe:2.3:o:blackberry:qnx_os_for_safety:2.0:4:*:*:*:*:*:*",
              "versionType": "cpe"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "QNX OS for Medical",
          "vendor": "BlackBerry Ltd",
          "versions": [
            {
              "status": "affected",
              "version": "cpe:2.3:o:blackberry:qnx_os_for_medical:2.0:3:*:*:*:*:*:*",
              "versionType": "cpe"
            }
          ]
        }
      ],
      "datePublic": "2026-11-10T17:15:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper Input Validation in a procnto message handler could allow an attacker with local access to send a crafted message which can cause an information disclosure in the QNX Neutrino kernel\u0026nbsp;"
            }
          ],
          "value": "Improper Input Validation in a procnto message handler could allow an attacker with local access to send a crafted message which can cause an information disclosure in the QNX Neutrino kernel"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-153",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-153 Input Data Manipulation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1287",
              "description": "CWE-1287 Improper validation of specified type of input",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-10T19:06:57.717Z",
        "orgId": "dbe78b00-5e7b-4fda-8748-329789ecfc5c",
        "shortName": "blackberry"
      },
      "references": [
        {
          "url": "https://support.blackberry.com/pkb/s/article/141342"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Vulnerabilities in the QNX Neutrino kernel affect QNX Software Development Platform and QNX OS for Safety",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dbe78b00-5e7b-4fda-8748-329789ecfc5c",
    "assignerShortName": "blackberry",
    "cveId": "CVE-2026-40273",
    "datePublished": "2026-11-10T19:06:57.717Z",
    "dateReserved": "2026-04-10T17:41:10.441Z",
    "dateUpdated": "2026-11-10T19:06:57.717Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-40274 (GCVE-0-2026-40274)

Vulnerability from cvelistv5 – Published: 2026-11-10 19:03 – Updated: 2026-11-10 19:03