QNX Neutrino CVE-2026-4018

Two specific prerequisites must be simultaneously satisfied. First, the attacker must have local access to the QNX Neutrino system - the AV:L CVSS vector explicitly rules out remote exploitation. Second, the attacker's process must hold the PROCMGR_AID_TRACE process manager ability, a QNX-specific kernel capability that must be explicitly granted by a system administrator or embedded into a privileged application's process manager access control list; it is not available to ordinary local users by default. Beyond these prerequisites, the attacker must successfully win a kernel-level race condition (AC:H), which requires precise timing of concurrent trace commands within the narrow check-use window in the kernel - this is non-trivial and not automatable per SSVC. Exploitation is scoped to the vulnerable system only (S:U), limiting impact to the local QNX Neutrino kernel with no direct path to subsequent-system compromise through this flaw alone. The primary limiting factors for defenders are the non-default nature of PROCMGR_AID_TRACE and the race-condition reliability barrier.

All available signals converge on a moderate but access-gated real-world risk. The CVSS 3.1 score of 6.4 (Medium) is driven down from the high impact sub-scores (C:H/I:H/A:H) by two significant exploit barriers: AC:H reflecting the difficulty of reliably winning a kernel-level race condition, and PR:H reflecting the mandatory requirement for the PROCMGR_AID_TRACE process manager ability - a non-default, explicitly granted QNX capability. The AV:L vector eliminates any remote attack surface. EPSS at 0.09% (1st percentile) strongly corroborates that opportunistic or widespread exploitation is not anticipated. SSVC independently confirms exploitation status as none and marks the flaw as not automatable, consistent with the race-condition complexity barrier. The SSVC technical impact of total is notable and aligns with C:H/I:H/A:H - if an attacker does win the race, kernel-level compromise is the result. The most realistic threat actor is a malicious insider or a compromised privileged process within a QNX-based embedded deployment, particularly in safety or medical contexts where kernel availability carries heightened consequence. No conflicting signals between data sources are present; CVSS, EPSS, and SSVC are internally consistent.

A local attacker - such as a compromised privileged process or a malicious insider - holding the PROCMGR_AID_TRACE capability on a QNX Neutrino system issues crafted trace commands to the TraceEvent() system call in rapid succession, timing concurrent kernel operations to win the race between the kernel's check and use of the targeted resource. Depending on which resource is corrupted in the race window, the attacker can exfiltrate sensitive kernel memory, overwrite kernel data structures to alter system behavior, or force a kernel panic, crashing the RTOS and disrupting safety- or medical-critical operations. No public proof-of-concept exploit has been identified at time of analysis.