EUVD-2026-44319
GHSA-vqpx-jx44-jfm6
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Local-only attack via unprivileged system call; kernel crash yields full availability loss with no confidentiality or integrity impact.
Primary rating from Vendor (blackberry).
CVSS VectorVendor: blackberry
Lifecycle Timeline
1DescriptionCVE.org
Insufficient Parameter Validation in the SchedGet() system call could allow an attacker with local access to cause a crash of the QNX Neutrino kernel.
AnalysisAI
Kernel crash in BlackBerry QNX Neutrino is triggerable by any local, unprivileged user via a malformed SchedGet() system call, resulting in full system availability loss. Affected platforms include QNX Software Development Platform 7.0 and 7.1, QNX OS for Safety (multiple branches up to 2.2.8), and QNX OS for Medical 2.0.2 and earlier. No active exploitation has been identified (EPSS 0.11%, CISA SSVC exploitation: none), but the safety-critical operational contexts in which QNX is deployed - automotive, medical devices, industrial automation - make a kernel crash disproportionately consequential relative to the moderate CVSS score.
Technical ContextAI
The vulnerability is classified under CWE-233 (Improper Handling of Parameters), specifically a failure to validate caller-supplied parameters within the SchedGet() kernel system call. In the QNX Neutrino RTOS microkernel architecture, system calls are direct interfaces to the kernel; all processes - including unprivileged ones - can invoke them. If the kernel handler for SchedGet() does not properly bounds-check or type-validate input parameters before processing them, a crafted call can cause an unhandled kernel exception or assertion failure, resulting in a kernel panic and system halt. The affected CPE strings confirm three distinct BlackBerry QNX product lines: the general-purpose QNX Software Development Platform (SDP) 7.0/7.1 (cpe:2.3:a:blackberry:qnx_software_development_platform), the safety-certified QNX OS for Safety (cpe:2.3:o:blackberry:qnx_os_for_safety), and QNX OS for Medical (cpe:2.3:o:blackberry:qnx_os_for_medical), all of which share the underlying Neutrino kernel.
RemediationAI
The primary fix is to apply the vendor-supplied patches detailed in BlackBerry's security advisory at https://support.blackberry.com/pkb/s/article/141213, which covers all three affected product lines (QNX SDP 7.0/7.1, QNX OS for Safety, QNX OS for Medical). Exact patched build numbers are not independently confirmed from available data and must be obtained directly from the advisory. In safety-certified or medically-cleared deployments where OS updates require formal re-qualification (per IEC 61508, ISO 26262, or FDA requirements), patching may not be immediately deployable; in those cases, restrict local user accounts on QNX systems to the minimum necessary principals with code execution capability, since exploitation requires local access. Monitor for unexpected kernel restarts or watchdog-triggered reboots as an indicator of exploitation attempts. Note that restricting user accounts has the trade-off of potentially impacting legitimate application processes that rely on local execution.
Stack-based buffer overflow in the bpe_decompress function in (1) BlackBerry QNX Neutrino RTOS through 6.5.0 SP1 and (2)
Buffer overflow in phrelay in BlackBerry QNX Neutrino RTOS through 6.5.0 SP1 in the QNX Software Development Platform al
A security vulnerability in the PCX image codec in QNX SDP (CVSS 9.8) that allows an unauthenticated attacker. Critical
A remote code execution vulnerability in the BMP image codec of BlackBerry QNX SDP version(s) 6.4 to 7.1 could allow an
An integer overflow vulnerability in the calloc() function of the C runtime library of affected versions of BlackBerry®
An information disclosure and remote code execution vulnerability in the slinger web server of the BlackBerry QNX Softwa
In BlackBerry QNX Software Development Platform (SDP) 6.6.0, an elevation of privilege vulnerability in the default conf
An improper input validation vulnerability in the SGI Image Codec of QNX SDP version(s) 6.6, 7.0, and 7.1 could allow an
An information disclosure vulnerability leading to a potential local escalation of privilege in the procfs service (the
Local information disclosure, data tampering, and denial of service in the BlackBerry QNX Neutrino kernel stems from a s
Improper Input Validation in the Networking Stack of QNX SDP version(s) 6.6, 7.0, and 7.1 could allow an attacker to pot
Arbitrary code execution and denial of service in BlackBerry QNX Software Development Platform arises from the tracepars
Same weakness CWE-233 – Improper Handling of Parameters
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today