EUVD-2026-50441
GHSA-hpr2-7hh5-qhhf
Severity by source
AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Local file-parsing flaw needing a victim to open a crafted .kev (AV:L, UI:R) with non-trivial exploitation (AC:H), no auth (PR:N), and full memory-corruption impact (C/I/A:H).
Primary rating from Vendor (blackberry).
CVSS VectorVendor: blackberry
Lifecycle Timeline
2DescriptionCVE.org
Improper Input Validation in the decode() function of the traceparser library could allow an attacker with a corrupted kernel trace event log (.kev) file, to execute arbitrary code or cause a crash in processes that use libtraceparser in QNX hosts or targets.
AnalysisAI
Arbitrary code execution and denial of service in BlackBerry QNX Software Development Platform arises from the traceparser library (libtraceparser), where the decode() function fails to properly validate input from kernel trace event log (.kev) files. A local attacker who supplies a maliciously corrupted .kev file can crash - or potentially run code within - any host or target process that parses it with libtraceparser. Reported by BlackBerry with no public exploit identified at time of analysis; the CVSS 7.0 (AC:H, UI:R) reflects that exploitation requires a victim to process the attacker's crafted file.
Technical ContextAI
libtraceparser is BlackBerry QNX's tracing/analysis library used to decode kernel trace event log (.kev) files produced by QNX's instrumented kernel and tracelogger tooling, consumed on both development hosts and deployed QNX targets. The flaw is in the library's decode() routine and is classified as CWE-1284 (Improper Validation of Specified Quantity in Input) - a subclass of improper input validation where a length, count, or size field embedded in the .kev binary format is trusted without bounds/consistency checking. Parsing a malformed quantity field can drive out-of-bounds memory access or corruption, which is the mechanism behind both the crash and the potential code-execution outcomes.
RemediationAI
Apply the fix per the BlackBerry advisory at https://support.blackberry.com/pkb/s/article/141229 (Patch available per vendor advisory; no exact fixed version was provided in the input data, so confirm the patched libtraceparser/QNX SDP build directly with BlackBerry). As a compensating control until patched, treat .kev kernel trace files as untrusted input: do not open or process .kev files from untrusted or external sources, and restrict any automated pipelines or target processes that auto-ingest trace logs so they only consume files generated internally - the trade-off is loss of the ability to analyze externally supplied trace captures. Where feasible, run trace-parsing tools under reduced privileges or in a sandboxed/isolated account to contain a potential crash or code-execution, at the cost of some workflow friction.
Stack-based buffer overflow in the bpe_decompress function in (1) BlackBerry QNX Neutrino RTOS through 6.5.0 SP1 and (2)
Buffer overflow in phrelay in BlackBerry QNX Neutrino RTOS through 6.5.0 SP1 in the QNX Software Development Platform al
A security vulnerability in the PCX image codec in QNX SDP (CVSS 9.8) that allows an unauthenticated attacker. Critical
A remote code execution vulnerability in the BMP image codec of BlackBerry QNX SDP version(s) 6.4 to 7.1 could allow an
An integer overflow vulnerability in the calloc() function of the C runtime library of affected versions of BlackBerry®
An information disclosure and remote code execution vulnerability in the slinger web server of the BlackBerry QNX Softwa
In BlackBerry QNX Software Development Platform (SDP) 6.6.0, an elevation of privilege vulnerability in the default conf
An improper input validation vulnerability in the SGI Image Codec of QNX SDP version(s) 6.6, 7.0, and 7.1 could allow an
An information disclosure vulnerability leading to a potential local escalation of privilege in the procfs service (the
Local information disclosure, data tampering, and denial of service in the BlackBerry QNX Neutrino kernel stems from a s
Improper Input Validation in the Networking Stack of QNX SDP version(s) 6.6, 7.0, and 7.1 could allow an attacker to pot
Time-of-check time-of-use (TOCTOU) race condition in the TraceEvent() system call of BlackBerry QNX Neutrino RTOS permit
Share
External POC / Exploit Code
Leaving vuln.today