EUVD-2026-44321
GHSA-vm3p-4vxh-gffg
Severity by source
AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Local-only attack vector, PROCMGR_AID_TRACE capability mandates PR:H, kernel race condition mandates AC:H; full C/I/A impact applies at kernel level.
Primary rating from Vendor (blackberry).
CVSS VectorVendor: blackberry
Lifecycle Timeline
1DescriptionCVE.org
TOCTOU Race Condition in specific trace commands of the TraceEvent() system call could allow an attacker with local access and with the PROCMGR_AID_TRACE ability, to cause information disclosure, data tampering or a crash of the QNX Neutrino kernel.
AnalysisAI
Time-of-check time-of-use (TOCTOU) race condition in the TraceEvent() system call of BlackBerry QNX Neutrino RTOS permits local attackers holding the PROCMGR_AID_TRACE kernel capability to trigger information disclosure, data tampering, or a kernel crash across three distinct product lines including safety- and medical-certified variants. Affected deployments span QNX Software Development Platform 7.0-7.1, QNX OS for Safety through 2.2.8, and QNX OS for Medical through 2.0.2. No public exploit or active exploitation has been identified; EPSS places this in the 1st percentile for near-term in-the-wild exploitation probability, and SSVC confirms exploitation status as none, though SSVC technical impact is rated total reflecting the kernel-level blast radius when conditions are met.
Technical ContextAI
QNX Neutrino is a microkernel-based POSIX-compliant real-time operating system (RTOS) produced by BlackBerry and widely deployed in safety-critical, automotive, industrial, and medical embedded systems. The TraceEvent() system call provides privileged kernel instrumentation and tracing functionality. CWE-367 (Time-of-Check Time-of-Use) describes a race condition class where a resource's state is validated at one point in time but consumed at a later point, creating a window in which a concurrent operation can alter that resource before it is used. In this vulnerability, specific trace commands within TraceEvent() contain such a race window inside the QNX Neutrino kernel itself. CPE data confirms three affected product families: QNX Software Development Platform (cpe:2.3:a:blackberry:qnx_software_development_platform:7.0 and 7.1), QNX OS for Safety (cpe:2.3:o:blackberry:qnx_os_for_safety versions 2.0.3, 2.1.5, and 2.2.8), and QNX OS for Medical (cpe:2.3:o:blackberry:qnx_os_for_medical:2.0:2). The vulnerability operates at the kernel level, meaning successful exploitation directly affects the integrity and availability of the OS itself rather than a userspace application.
RemediationAI
The primary remediation is to apply the vendor-released patch documented in the BlackBerry security advisory at https://support.blackberry.com/pkb/s/article/141213. Exact fixed version numbers for each product line are not present in available input data and must be confirmed directly from the advisory, so administrators should review it for the specific patched release corresponding to their QNX SDP, QNX OS for Safety, or QNX OS for Medical deployment. Where patching cannot be applied immediately - common in certified safety or medical device environments requiring re-validation - the most effective compensating control is to audit and restrict assignment of the PROCMGR_AID_TRACE process manager ability to only those processes that strictly require kernel tracing; removing this ability from all non-essential principals eliminates the exploitation prerequisite entirely. Note that this control will disable kernel-level tracing and diagnostic workflows that depend on PROCMGR_AID_TRACE, which may impact development or monitoring tooling. Operators of safety-critical and medical systems should also review whether kernel crashes induced by this flaw could trigger fail-safe or fail-dangerous conditions in their deployment context and apply change management procedures accordingly.
Stack-based buffer overflow in the bpe_decompress function in (1) BlackBerry QNX Neutrino RTOS through 6.5.0 SP1 and (2)
Buffer overflow in phrelay in BlackBerry QNX Neutrino RTOS through 6.5.0 SP1 in the QNX Software Development Platform al
A security vulnerability in the PCX image codec in QNX SDP (CVSS 9.8) that allows an unauthenticated attacker. Critical
A remote code execution vulnerability in the BMP image codec of BlackBerry QNX SDP version(s) 6.4 to 7.1 could allow an
An integer overflow vulnerability in the calloc() function of the C runtime library of affected versions of BlackBerry®
An information disclosure and remote code execution vulnerability in the slinger web server of the BlackBerry QNX Softwa
In BlackBerry QNX Software Development Platform (SDP) 6.6.0, an elevation of privilege vulnerability in the default conf
An improper input validation vulnerability in the SGI Image Codec of QNX SDP version(s) 6.6, 7.0, and 7.1 could allow an
An information disclosure vulnerability leading to a potential local escalation of privilege in the procfs service (the
Local information disclosure, data tampering, and denial of service in the BlackBerry QNX Neutrino kernel stems from a s
Improper Input Validation in the Networking Stack of QNX SDP version(s) 6.6, 7.0, and 7.1 could allow an attacker to pot
Arbitrary code execution and denial of service in BlackBerry QNX Software Development Platform arises from the tracepars
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today