EUVD-2026-44320
GHSA-8422-84vm-vcr2
Severity by source
AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Reachable only via local syscall so AV:L; overflow depends on memory layout so AC:H; any unprivileged local process can call TraceEvent() so PR:N; kernel-context corruption gives full C/I/A.
Primary rating from Vendor (blackberry).
CVSS VectorVendor: blackberry
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
Buffer Overflow in the entry handler of the TraceEvent() system call could allow an attacker with local access to cause information disclosure, data tampering or a crash of the QNX Neutrino kernel.
AnalysisAI
Local information disclosure, data tampering, and denial of service in the BlackBerry QNX Neutrino kernel stems from a stack buffer overflow in the entry handler of the TraceEvent() system call, affecting QNX Software Development Platform, QNX OS for Safety, and QNX OS for Medical. An attacker able to run code on the target can craft malicious TraceEvent() arguments to corrupt kernel stack memory, leaking sensitive kernel data, altering kernel state, or crashing the RTOS. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires local code execution on a device running the QNX Neutrino kernel: the attacker must be able to run a process that invokes the TraceEvent() system call and pass it crafted arguments that overflow the entry handler's stack buffer. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score is 7.4 (High) with vector AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - a local-only attack vector, high attack complexity, and no privilege requirement, yielding full high impact to confidentiality, integrity, and availability but confined to the vulnerable component (S:U). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has already gained the ability to run an unprivileged process on a QNX-based device - for example via a compromised application on an automotive infotainment unit or medical device - invokes TraceEvent() with carefully crafted arguments that overflow a fixed-size kernel stack buffer. By tuning the input they read back adjacent kernel memory (information disclosure), overwrite kernel data (tampering), or reliably crash the microkernel (denial of service). … |
| Remediation | Patch available per vendor advisory - consult the BlackBerry support bulletin at https://support.blackberry.com/pkb/s/article/141213 for the fixed releases of QNX Software Development Platform, QNX OS for Safety, and QNX OS for Medical, and apply the vendor-supplied kernel update to affected devices; exact fix version numbers are not stated in the available data and must be taken from that advisory. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Conduct urgent inventory of all QNX OS for Safety and QNX OS for Medical systems in production, prioritizing medical device and safety-critical applications. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Stack-based buffer overflow in the bpe_decompress function in (1) BlackBerry QNX Neutrino RTOS through 6.5.0 SP1 and (2)
Buffer overflow in phrelay in BlackBerry QNX Neutrino RTOS through 6.5.0 SP1 in the QNX Software Development Platform al
A security vulnerability in the PCX image codec in QNX SDP (CVSS 9.8) that allows an unauthenticated attacker. Critical
A remote code execution vulnerability in the BMP image codec of BlackBerry QNX SDP version(s) 6.4 to 7.1 could allow an
An integer overflow vulnerability in the calloc() function of the C runtime library of affected versions of BlackBerry®
An information disclosure and remote code execution vulnerability in the slinger web server of the BlackBerry QNX Softwa
In BlackBerry QNX Software Development Platform (SDP) 6.6.0, an elevation of privilege vulnerability in the default conf
An improper input validation vulnerability in the SGI Image Codec of QNX SDP version(s) 6.6, 7.0, and 7.1 could allow an
An information disclosure vulnerability leading to a potential local escalation of privilege in the procfs service (the
Improper Input Validation in the Networking Stack of QNX SDP version(s) 6.6, 7.0, and 7.1 could allow an attacker to pot
TOCTOU Race Condition in specific trace commands of the TraceEvent() system call could allow an attacker with local acce
Insufficient Parameter Validation in the SchedGet() system call could allow an attacker with local access to cause a cra
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today