EUVD-2026-44320
GHSA-8422-84vm-vcr2
Severity by source
AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Reachable only via local syscall so AV:L; overflow depends on memory layout so AC:H; any unprivileged local process can call TraceEvent() so PR:N; kernel-context corruption gives full C/I/A.
Primary rating from Vendor (blackberry).
CVSS VectorVendor: blackberry
Lifecycle Timeline
2DescriptionCVE.org
Buffer Overflow in the entry handler of the TraceEvent() system call could allow an attacker with local access to cause information disclosure, data tampering or a crash of the QNX Neutrino kernel.
AnalysisAI
Local information disclosure, data tampering, and denial of service in the BlackBerry QNX Neutrino kernel stems from a stack buffer overflow in the entry handler of the TraceEvent() system call, affecting QNX Software Development Platform, QNX OS for Safety, and QNX OS for Medical. An attacker able to run code on the target can craft malicious TraceEvent() arguments to corrupt kernel stack memory, leaking sensitive kernel data, altering kernel state, or crashing the RTOS. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; exploitation is rated high-complexity (AC:H) despite requiring no prior privileges.
Technical ContextAI
QNX Neutrino is a commercial POSIX-compliant real-time microkernel operating system used heavily in safety-critical embedded systems (automotive ECUs, medical devices, industrial control). TraceEvent() is a QNX kernel system call used for instrumentation and event tracing of the microkernel. Per CWE-121 (Stack-based Buffer Overflow) and the vendor tags (Buffer Overflow, Stack Overflow), the syscall's entry handler copies attacker-controlled input into a fixed-size kernel stack buffer without adequate bounds checking, allowing adjacent stack memory - including saved registers, return addresses, or kernel data structures - to be overwritten or over-read. Because the fault occurs in kernel context, its impact crosses the user/kernel trust boundary. Affected CPEs are cpe:2.3:a:blackberry_ltd:qnx_software_development_platform, cpe:2.3:a:blackberry_ltd:qnx_os_for_safety, and cpe:2.3:a:blackberry_ltd.:qnx_os_for_medical.
RemediationAI
Patch available per vendor advisory - consult the BlackBerry support bulletin at https://support.blackberry.com/pkb/s/article/141213 for the fixed releases of QNX Software Development Platform, QNX OS for Safety, and QNX OS for Medical, and apply the vendor-supplied kernel update to affected devices; exact fix version numbers are not stated in the available data and must be taken from that advisory. Because exploitation requires local code execution, effective compensating controls until patching include restricting which processes and users can run on the device, enforcing least-privilege and application allow-listing on embedded/production images to prevent untrusted local code, and, where the device's tracing/instrumentation functionality is not required in production, disabling or gating access to kernel tracing so untrusted processes cannot reach the TraceEvent() path (trade-off: loss of on-device diagnostic/tracing capability). For safety- and medical-certified deployments, coordinate any change with recertification and vendor guidance, as kernel updates may require re-validation.
Stack-based buffer overflow in the bpe_decompress function in (1) BlackBerry QNX Neutrino RTOS through 6.5.0 SP1 and (2)
Buffer overflow in phrelay in BlackBerry QNX Neutrino RTOS through 6.5.0 SP1 in the QNX Software Development Platform al
A security vulnerability in the PCX image codec in QNX SDP (CVSS 9.8) that allows an unauthenticated attacker. Critical
A remote code execution vulnerability in the BMP image codec of BlackBerry QNX SDP version(s) 6.4 to 7.1 could allow an
An integer overflow vulnerability in the calloc() function of the C runtime library of affected versions of BlackBerry®
An information disclosure and remote code execution vulnerability in the slinger web server of the BlackBerry QNX Softwa
In BlackBerry QNX Software Development Platform (SDP) 6.6.0, an elevation of privilege vulnerability in the default conf
An improper input validation vulnerability in the SGI Image Codec of QNX SDP version(s) 6.6, 7.0, and 7.1 could allow an
An information disclosure vulnerability leading to a potential local escalation of privilege in the procfs service (the
Improper Input Validation in the Networking Stack of QNX SDP version(s) 6.6, 7.0, and 7.1 could allow an attacker to pot
Arbitrary code execution and denial of service in BlackBerry QNX Software Development Platform arises from the tracepars
Time-of-check time-of-use (TOCTOU) race condition in the TraceEvent() system call of BlackBerry QNX Neutrino RTOS permit
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today