Vulnerabilities in the QNX Neutrino kernel affect QNX Software Development Platform and QNX OS for Safety
CVE-2026-40274

4MEDIUM

Key Information:

Vendor: Blackberry Ltd
Status: Qnx Software Development Platform (sdp); Qnx Os For Safety; Qnx Os For Medical
Vendor: CVE Published:; 10 November 2026

🔔 Create Blackberry Ltd Vulnerability Alert

What is CVE-2026-40274?

Invalid Pointer Reference in the TimerSettime() system call could allow an attacker with local access to arm a crafted timer event which can cause an information disclosure in the QNX Neutrino kernel.

Affected Version(s)

QNX OS for Medical cpe:2.3:o:blackberry:qnx_os_for_medical:2.0:3:*:*:*:*:*:*

QNX OS for Safety cpe:2.3:o:blackberry:qnx_os_for_safety:2.2:9:*:*:*:*:*:*

QNX OS for Safety cpe:2.3:o:blackberry:qnx_os_for_safety:2.1:6:*:*:*:*:*:*

References

https://support.blackberry.com/pkb/s/article/141342

CVSS V3.1

Score:

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

None

Availability:

Low

Attack Vector:

Local

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

None

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Nov 10, 2026
Vulnerability Reserved
Apr 10, 2026

CVE-2026-40274 Data

JSON