QNX SDP CVE-2026-40272

Exploitation requires the victim to process an attacker-supplied, corrupted kernel trace event log (.kev) file with a tool or process that links libtraceparser and calls its decode() function - this file-parsing action is the mandatory user interaction (UI:R). No authentication or prior privileges are needed (PR:N), but the vector is local (AV:L): the attacker must get their malicious .kev file onto the host/target and get it parsed. Limiting factors are the high attack complexity (AC:H, implying non-trivial control over memory layout for reliable code execution rather than a mere crash), the requirement that the environment actually uses QNX tracing/libtraceparser, and that no remote or automatic trigger exists.

Signals are moderate and internally consistent rather than alarming. The CVSS vector (AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H = 7.0 High) shows local vector, high attack complexity, and mandatory user interaction - an attacker cannot reach this remotely or automatically; a user or process must be induced to parse an attacker-controlled .kev file. There is no CISA KEV listing and no public POC, so this is not a demonstrated at-scale threat. No EPSS score was provided in the input, so exploitation probability cannot be quantified here. The high AC and required UI meaningfully cap real-world risk despite the C/I/A:H impact triad; the realistic worst case is a developer/analyst workstation or a QNX target that automatically ingests untrusted trace files. Note the description says 'could allow ... execute arbitrary code' - code execution is stated as possible, not confirmed reliable, so the impact ceiling is somewhat speculative.

An attacker crafts a corrupted .kev kernel trace log with a malformed length/quantity field and delivers it to a QNX developer or an automated analysis process (e.g. shared as a 'bug reproduction' trace or dropped where a target auto-parses trace logs). When the victim's tool invokes libtraceparser's decode() on the file, the unvalidated input triggers memory corruption, crashing the process or potentially executing attacker code in its context. No public POC is currently identified, and the high complexity plus required user interaction make delivery, not exploitation reliability, the main hurdle.