QNX Neutrino CVE-2026-0515

Exploitation requires the ability to execute arbitrary code locally on an affected QNX Neutrino system and invoke the SchedGet() system call. The CVSS PR:N rating confirms no elevated privileges are required - any authenticated local user or process with execution rights is sufficient. The attack is strictly local (AV:L) and cannot be triggered remotely or over the network without first obtaining local code execution through another means. No special configuration, non-default feature, or elevated mode is described as a prerequisite; the vulnerable code path is in a standard kernel system call handler available to all processes. Exploitation is bounded to the affected version ranges: QNX SDP 7.0 and 7.1, QNX OS for Safety up to 2.0.3, 2.1.5, or 2.2.8 (by branch), and QNX OS for Medical up to 2.0.2.

The CVSS 3.1 vector AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H scores 6.2 and accurately reflects a locally exploitable, low-complexity denial-of-service with zero confidentiality or integrity impact. PR:N confirms that no elevated privileges are needed - any local user with code execution can trigger the crash. EPSS at 0.11% (2nd percentile) indicates negligible exploitation probability, and CISA SSVC independently classifies exploitation as 'none,' the attack as not automatable, and technical impact as 'partial.' No KEV listing exists and no public exploit code has been identified. Taken together, these signals consistently place this at low operational priority for general-purpose environments. The critical caveat is deployment context: QNX Neutrino underpins safety-critical systems in automotive ECUs (ISO 26262), medical devices (IEC 62304/FDA), and industrial controllers where an unexpected kernel crash is not merely an inconvenience but potentially a safety event. Defenders in those verticals should treat availability impact with higher urgency than the numeric CVSS score suggests, independent of exploitation likelihood.

A local user without elevated privileges on a QNX Neutrino system invokes the SchedGet() system call with intentionally malformed or out-of-bounds parameter values. The kernel handler processes the parameters without adequate validation, triggering a kernel exception that crashes the Neutrino microkernel. In an embedded real-time system without hardware redundancy or failover - such as an automotive ECU or medical device controller - this results in a complete system halt or forced reboot, interrupting any time-critical function the platform was managing. No public exploit code exists at time of analysis.