Improper Input Validation in io-char Library's Character I/O Device Driver by BlackBerry
CVE-2026-54437

6.2MEDIUM

Key Information:

Vendor

Blackberry Ltd

Status
Qnx Software Development Platform
Vendor
CVE Published:
10 November 2026

What is CVE-2026-54437?

The io-char library contains an improper input validation vulnerability in its DCMD_CHR_TCINJECTC devctl() handler. This flaw can allow local attackers to manipulate the memory input buffer of the Character I/O device driver, potentially leading to unauthorized changes and data tampering. It is crucial for users of this library to review their systems for the impacted versions and apply relevant updates or mitigations to safeguard against potential exploitation. For further details, refer to the guidance provided by BlackBerry.

Affected Version(s)

QNX Software Development Platform cpe:2.3:a:blackberry:qnx_software_development_platform:8.0:*:*:*:*:*:*:*

QNX Software Development Platform cpe:2.3:a:blackberry:qnx_software_development_platform:7.1:*:*:*:*:*:*:*

QNX Software Development Platform cpe:2.3:a:blackberry:qnx_software_development_platform:7.0:*:*:*:*:*:*:*

References

https://support.blackberry.com/pkb/s/article/141341

CVSS V3.1

Score:
6.2
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.