Heap-based Buffer Overflow in QNX Neutrino Kernel by BlackBerry
CVE-2026-40275

8.4HIGH

Key Information:

Vendor

Blackberry Ltd

Status
Qnx Software Development Platform
Qnx Os For Safety
Qnx Os For Medical
Vendor
CVE Published:
10 November 2026

What is CVE-2026-40275?

A heap-based buffer overflow vulnerability exists in the DCMD_PROC_EVENT handler of the QNX Neutrino kernel, potentially allowing an attacker with local access to manipulate system data, disclose sensitive information, or crash the operating system. This could lead to severe operational disruptions and compromise system integrity, emphasizing the importance of prompt security measures to mitigate such risks.

Affected Version(s)

QNX OS for Medical cpe:2.3:o:blackberry:qnx_os_for_medical:2.0:3:*:*:*:*:*:*

QNX OS for Safety cpe:2.3:o:blackberry:qnx_os_for_safety:2.2:9:*:*:*:*:*:*

QNX OS for Safety cpe:2.3:o:blackberry:qnx_os_for_safety:2.1:6:*:*:*:*:*:*

References

https://support.blackberry.com/pkb/s/article/141342

CVSS V3.1

Score:
8.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.