QNX Neutrino CVE-2026-4017

Exploitation requires local code execution on a device running the QNX Neutrino kernel: the attacker must be able to run a process that invokes the TraceEvent() system call and pass it crafted arguments that overflow the entry handler's stack buffer. No prior privileges are required (PR:N) - any local process can call the syscall - and no user interaction is needed. What limits exploitation is the local-only attack vector (AV:L, so the attacker must first obtain code execution on the target) combined with high attack complexity (AC:H), implying the overflow depends on specific memory layout, timing, or crafted input that is not trivially reliable. Applicability is bounded to the three named QNX OS products; the wildcard CPE versions mean affected version ranges are not confirmed in the provided data.

The CVSS 3.1 base score is 7.4 (High) with vector AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - a local-only attack vector, high attack complexity, and no privilege requirement, yielding full high impact to confidentiality, integrity, and availability but confined to the vulnerable component (S:U). The high-impact triad is consistent with the description's information disclosure, data tampering, and kernel crash outcomes. Real-world urgency is tempered by several signals: the vector requires local access (AV:L), meaning an attacker must already execute code on the device, and AC:H indicates a non-trivial, timing- or layout-dependent exploit. No EPSS score was provided in the input, no KEV listing exists, and no POC was referenced, so there is no evidence of active or widespread exploitation. One tension worth verifying: the vector lists PR:N (no privileges) even though the flaw is only reachable locally - this reflects that any unprivileged local process can invoke the syscall, not that the bug is remotely reachable. Overall this is a genuine kernel-integrity issue for QNX-based devices but is a targeted, post-access risk rather than a mass-exploitation internet-facing threat.

An attacker who has already gained the ability to run an unprivileged process on a QNX-based device - for example via a compromised application on an automotive infotainment unit or medical device - invokes TraceEvent() with carefully crafted arguments that overflow a fixed-size kernel stack buffer. By tuning the input they read back adjacent kernel memory (information disclosure), overwrite kernel data (tampering), or reliably crash the microkernel (denial of service). No public exploit is identified at time of analysis, and the high attack complexity (AC:H) means a working exploit likely requires precise control of memory layout or timing.