Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
8 vulnerabilities by BlackBerry Ltd
CVE-2026-4018 (GCVE-0-2026-4018)
Vulnerability from nvd – Published: 2026-07-14 17:34 – Updated: 2026-07-15 14:01
VLAI
EPSS
VEX
Title
TOCTOU race condition in the QNX Neutrino kernel impacts versions of the QNX Software Development Platform and QNX OS for Safety
Summary
TOCTOU Race Condition in specific trace commands of the TraceEvent() system call could allow an attacker with local access and with the PROCMGR_AID_TRACE ability, to cause information disclosure, data tampering or a crash of the QNX Neutrino kernel.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-367 - Time-of-check time-of-use (TOCTOU) race condition
Assigner
References
1 reference
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| BlackBerry Ltd | QNX Software Development Platform |
Affected:
7.1
Affected: cpe:2.3:a:blackberry:qnx_software_development_platform:7.1:*:*:*:*:*:*:* (cpe) Affected: 7.0 Affected: cpe:2.3:a:blackberry:qnx_software_development_platform:7.0:*:*:*:*:*:*:* (cpe) |
|
| BlackBerry Ltd | QNX OS for Safety |
Affected:
2.2.8 and earlier
Affected: cpe:2.3:o:blackberry:qnx_os_for_safety:2.2:8:*:*:*:*:*:* (cpe) Affected: 2.1.5 and earlier Affected: cpe:2.3:o:blackberry:qnx_os_for_safety:2.1:5:*:*:*:*:*:* (cpe) Affected: 2.0.3 and earlier Affected: cpe:2.3:o:blackberry:qnx_os_for_safety:2.0:3:*:*:*:*:*:* (cpe) |
|
| BlackBerry Ltd. | QNX OS for Medical |
Affected:
2.0.2 and earlier
Affected: cpe:2.3:o:blackberry:qnx_os_for_medical:2.0:2:*:*:*:*:*:* (cpe) |
Date Public
2026-07-14 15:20
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-4018",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-15T14:00:49.532095Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-15T14:01:13.318Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "QNX Software Development Platform",
"vendor": "BlackBerry Ltd",
"versions": [
{
"status": "affected",
"version": "7.1"
},
{
"status": "affected",
"version": "cpe:2.3:a:blackberry:qnx_software_development_platform:7.1:*:*:*:*:*:*:*",
"versionType": "cpe"
},
{
"status": "affected",
"version": "7.0"
},
{
"status": "affected",
"version": "cpe:2.3:a:blackberry:qnx_software_development_platform:7.0:*:*:*:*:*:*:*",
"versionType": "cpe"
}
]
},
{
"defaultStatus": "unaffected",
"product": "QNX OS for Safety",
"vendor": "BlackBerry Ltd",
"versions": [
{
"status": "affected",
"version": "2.2.8 and earlier"
},
{
"status": "affected",
"version": "cpe:2.3:o:blackberry:qnx_os_for_safety:2.2:8:*:*:*:*:*:*",
"versionType": "cpe"
},
{
"status": "affected",
"version": "2.1.5 and earlier"
},
{
"status": "affected",
"version": "cpe:2.3:o:blackberry:qnx_os_for_safety:2.1:5:*:*:*:*:*:*",
"versionType": "cpe"
},
{
"status": "affected",
"version": "2.0.3 and earlier"
},
{
"status": "affected",
"version": "cpe:2.3:o:blackberry:qnx_os_for_safety:2.0:3:*:*:*:*:*:*",
"versionType": "cpe"
}
]
},
{
"defaultStatus": "unaffected",
"product": "QNX OS for Medical",
"vendor": "BlackBerry Ltd.",
"versions": [
{
"status": "affected",
"version": "2.0.2 and earlier"
},
{
"status": "affected",
"version": "cpe:2.3:o:blackberry:qnx_os_for_medical:2.0:2:*:*:*:*:*:*",
"versionType": "cpe"
}
]
}
],
"datePublic": "2026-07-14T15:20:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "TOCTOU Race Condition in specific trace commands of the TraceEvent() system call could allow an attacker with local access and with the PROCMGR_AID_TRACE ability, to cause information disclosure, data tampering or a crash of the QNX Neutrino kernel."
}
],
"value": "TOCTOU Race Condition in specific trace commands of the TraceEvent() system call could allow an attacker with local access and with the PROCMGR_AID_TRACE ability, to cause information disclosure, data tampering or a crash of the QNX Neutrino kernel."
}
],
"impacts": [
{
"capecId": "CAPEC-29",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-29 Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-367",
"description": "CWE-367 Time-of-check time-of-use (TOCTOU) race condition",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T17:34:01.952Z",
"orgId": "dbe78b00-5e7b-4fda-8748-329789ecfc5c",
"shortName": "blackberry"
},
"references": [
{
"url": "https://support.blackberry.com/pkb/s/article/141213"
}
],
"source": {
"advisory": "https://support.blackberry.com/pkb/s/article/141213",
"discovery": "UNKNOWN"
},
"title": "TOCTOU race condition in the QNX Neutrino kernel impacts versions of the QNX Software Development Platform and QNX OS for Safety",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "dbe78b00-5e7b-4fda-8748-329789ecfc5c",
"assignerShortName": "blackberry",
"cveId": "CVE-2026-4018",
"datePublished": "2026-07-14T17:34:01.952Z",
"dateReserved": "2026-03-11T19:24:46.531Z",
"dateUpdated": "2026-07-15T14:01:13.318Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-4017 (GCVE-0-2026-4017)
Vulnerability from nvd – Published: 2026-07-14 17:25 – Updated: 2026-07-14 23:36
VLAI
EPSS
VEX
Title
Buffer overflow in the QNX Neutrino kernel impacts versions of the QNX Software Development Platform and QNX OS for Safety
Summary
Buffer Overflow in the entry handler of the TraceEvent() system call could allow an attacker with local access to cause information disclosure, data tampering or a crash of the QNX Neutrino kernel.
Severity
7.4 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-121 - Stack-based buffer overflow
Assigner
References
1 reference
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| BlackBerry Ltd | QNX Software Development Platform |
Affected:
7.1
Affected: cpe:2.3:a:blackberry:qnx_software_development_platform:7.1:*:*:*:*:*:*:* (cpe) Affected: 7.0 Affected: cpe:2.3:a:blackberry:qnx_software_development_platform:7.0:*:*:*:*:*:*:* (cpe) |
|
| BlackBerry Ltd | QNX OS for Safety |
Affected:
2.2.8 and earlier
Affected: cpe:2.3:o:blackberry:qnx_os_for_safety:2.2:8:*:*:*:*:*:* (cpe) Affected: 2.1.5 and earlier Affected: cpe:2.3:o:blackberry:qnx_os_for_safety:2.1:5:*:*:*:*:*:* (cpe) Affected: 2.0.3 and earlier Affected: cpe:2.3:o:blackberry:qnx_os_for_safety:2.0:3:*:*:*:*:*:* (cpe) |
|
| BlackBerry Ltd. | QNX OS for Medical |
Affected:
2.0.2 and earlier
Affected: cpe:2.3:o:blackberry:qnx_os_for_medical:2.0:2:*:*:*:*:*:* (cpe) |
Date Public
2026-07-14 15:15
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-4017",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-14T23:36:16.979515Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T23:36:28.181Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "QNX Software Development Platform",
"vendor": "BlackBerry Ltd",
"versions": [
{
"status": "affected",
"version": "7.1"
},
{
"status": "affected",
"version": "cpe:2.3:a:blackberry:qnx_software_development_platform:7.1:*:*:*:*:*:*:*",
"versionType": "cpe"
},
{
"status": "affected",
"version": "7.0"
},
{
"status": "affected",
"version": "cpe:2.3:a:blackberry:qnx_software_development_platform:7.0:*:*:*:*:*:*:*",
"versionType": "cpe"
}
]
},
{
"defaultStatus": "unaffected",
"product": "QNX OS for Safety",
"vendor": "BlackBerry Ltd",
"versions": [
{
"status": "affected",
"version": "2.2.8 and earlier"
},
{
"status": "affected",
"version": "cpe:2.3:o:blackberry:qnx_os_for_safety:2.2:8:*:*:*:*:*:*",
"versionType": "cpe"
},
{
"status": "affected",
"version": "2.1.5 and earlier"
},
{
"status": "affected",
"version": "cpe:2.3:o:blackberry:qnx_os_for_safety:2.1:5:*:*:*:*:*:*",
"versionType": "cpe"
},
{
"status": "affected",
"version": "2.0.3 and earlier"
},
{
"status": "affected",
"version": "cpe:2.3:o:blackberry:qnx_os_for_safety:2.0:3:*:*:*:*:*:*",
"versionType": "cpe"
}
]
},
{
"defaultStatus": "unaffected",
"product": "QNX OS for Medical",
"vendor": "BlackBerry Ltd.",
"versions": [
{
"status": "affected",
"version": "2.0.2 and earlier"
},
{
"status": "affected",
"version": "cpe:2.3:o:blackberry:qnx_os_for_medical:2.0:2:*:*:*:*:*:*",
"versionType": "cpe"
}
]
}
],
"datePublic": "2026-07-14T15:15:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Buffer Overflow in the entry handler of the TraceEvent() system call could allow an attacker with local access to cause information disclosure, data tampering or a crash of the QNX Neutrino kernel.\u0026nbsp;"
}
],
"value": "Buffer Overflow in the entry handler of the TraceEvent() system call could allow an attacker with local access to cause information disclosure, data tampering or a crash of the QNX Neutrino kernel."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121 Stack-based buffer overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T17:25:13.128Z",
"orgId": "dbe78b00-5e7b-4fda-8748-329789ecfc5c",
"shortName": "blackberry"
},
"references": [
{
"url": "https://support.blackberry.com/pkb/s/article/141213"
}
],
"source": {
"advisory": "https://support.blackberry.com/pkb/s/article/141213",
"discovery": "UNKNOWN"
},
"title": "Buffer overflow in the QNX Neutrino kernel impacts versions of the QNX Software Development Platform and QNX OS for Safety",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "dbe78b00-5e7b-4fda-8748-329789ecfc5c",
"assignerShortName": "blackberry",
"cveId": "CVE-2026-4017",
"datePublished": "2026-07-14T17:25:13.128Z",
"dateReserved": "2026-03-11T19:20:13.205Z",
"dateUpdated": "2026-07-14T23:36:28.181Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-0515 (GCVE-0-2026-0515)
Vulnerability from nvd – Published: 2026-07-14 17:13 – Updated: 2026-07-14 23:35
VLAI
EPSS
VEX
Title
Insufficient parameter validation in the QNX Neutrino kernel impacts versions of the QNX Software Development Platform and QNX OS for Safety
Summary
Insufficient Parameter Validation in the SchedGet() system call could allow an attacker with local access to cause a crash of the QNX Neutrino kernel.
Severity
6.2 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-233 - Improper handling of parameters
Assigner
References
1 reference
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| BlackBerry Ltd | QNX Software Development Platform |
Affected:
7.1
Affected: cpe:2.3:a:blackberry:qnx_software_development_platform:7.1:*:*:*:*:*:*:* (cpe) Affected: 7.0 Affected: cpe:2.3:a:blackberry:qnx_software_development_platform:7.0:*:*:*:*:*:*:* |
|
| BlackBerry Ltd | QNX OS for Safety |
Affected:
2.2.8 and earlier
Affected: cpe:2.3:o:blackberry:qnx_os_for_safety:2.2:8:*:*:*:*:*:* (cpe) Affected: 2.1.5 and earlier Affected: cpe:2.3:o:blackberry:qnx_os_for_safety:2.1:5:*:*:*:*:*:* (cpe) Affected: 2.0.3 and earlier Affected: cpe:2.3:o:blackberry:qnx_os_for_safety:2.0:3:*:*:*:*:*:* (cpe) |
|
| BlackBerry Ltd. | QNX OS for Medical |
Affected:
2.0.2 and earlier
Affected: cpe:2.3:o:blackberry:qnx_os_for_medical:2.0:2:*:*:*:*:*:* (cpe) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-0515",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-14T23:35:18.765970Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T23:35:27.900Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "QNX Software Development Platform",
"vendor": "BlackBerry Ltd",
"versions": [
{
"status": "affected",
"version": "7.1"
},
{
"status": "affected",
"version": "cpe:2.3:a:blackberry:qnx_software_development_platform:7.1:*:*:*:*:*:*:*",
"versionType": "cpe"
},
{
"status": "affected",
"version": "7.0"
},
{
"status": "affected",
"version": "cpe:2.3:a:blackberry:qnx_software_development_platform:7.0:*:*:*:*:*:*:*"
}
]
},
{
"defaultStatus": "unaffected",
"product": "QNX OS for Safety",
"vendor": "BlackBerry Ltd",
"versions": [
{
"status": "affected",
"version": "2.2.8 and earlier"
},
{
"status": "affected",
"version": "cpe:2.3:o:blackberry:qnx_os_for_safety:2.2:8:*:*:*:*:*:*",
"versionType": "cpe"
},
{
"status": "affected",
"version": "2.1.5 and earlier"
},
{
"status": "affected",
"version": "cpe:2.3:o:blackberry:qnx_os_for_safety:2.1:5:*:*:*:*:*:*",
"versionType": "cpe"
},
{
"status": "affected",
"version": "2.0.3 and earlier"
},
{
"status": "affected",
"version": "cpe:2.3:o:blackberry:qnx_os_for_safety:2.0:3:*:*:*:*:*:*",
"versionType": "cpe"
}
]
},
{
"defaultStatus": "unaffected",
"product": "QNX OS for Medical",
"vendor": "BlackBerry Ltd.",
"versions": [
{
"status": "affected",
"version": "2.0.2 and earlier"
},
{
"status": "affected",
"version": "cpe:2.3:o:blackberry:qnx_os_for_medical:2.0:2:*:*:*:*:*:*",
"versionType": "cpe"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Insufficient Parameter Validation in the SchedGet() system call could allow an attacker with local access to cause a crash of the QNX Neutrino kernel."
}
],
"value": "Insufficient Parameter Validation in the SchedGet() system call could allow an attacker with local access to cause a crash of the QNX Neutrino kernel."
}
],
"impacts": [
{
"capecId": "CAPEC-153",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-153 Input Data Manipulation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-233",
"description": "CWE-233 Improper handling of parameters",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T17:13:07.258Z",
"orgId": "dbe78b00-5e7b-4fda-8748-329789ecfc5c",
"shortName": "blackberry"
},
"references": [
{
"url": "https://support.blackberry.com/pkb/s/article/141213"
}
],
"source": {
"advisory": "https://support.blackberry.com/pkb/s/article/141213",
"discovery": "UNKNOWN"
},
"title": "Insufficient parameter validation in the QNX Neutrino kernel impacts versions of the QNX Software Development Platform and QNX OS for Safety",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "dbe78b00-5e7b-4fda-8748-329789ecfc5c",
"assignerShortName": "blackberry",
"cveId": "CVE-2026-0515",
"datePublished": "2026-07-14T17:13:07.258Z",
"dateReserved": "2025-12-10T15:04:59.507Z",
"dateUpdated": "2026-07-14T23:35:27.900Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-8090 (GCVE-0-2025-8090)
Vulnerability from nvd – Published: 2026-01-13 16:36 – Updated: 2026-01-13 21:41
VLAI
EPSS
VEX
Title
Vulnerability in the QNX Neutrino Kernel impacts the QNX Software Development Platform and QNX OS for Safety
Summary
Null pointer dereference in the MsgRegisterEvent() system call could allow an attacker with local access and code execution abilities to crash the QNX Neutrino kernel.
Severity
6.2 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-476 - NULL Pointer Dereference
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://support.blackberry.com/pkb/s/article/141027 | vendor-advisory |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| BlackBerry Ltd | QNX Software Development Platform |
Affected:
7.1 and 7.0
(custom)
Affected: cpe:2.3:a:blackberry:qnx_software_development_platform:7.1:*:*:*:*:*:*:* (cpe) Affected: cpe:2.3:a:blackberry:qnx_software_development_platform:7.0:*:*:*:*:*:*:* (cpe) |
|
| BlackBerry Ltd | QNX OS for Safety |
Affected:
2.2.7 and earlier
(custom)
Affected: cpe:2.3:o:blackberry:qnx_os_for_safety:2.2:7:*:*:*:*:*:* (cpe) Affected: 2.1.4 and earlier (custom) Affected: cpe:2.3:o:blackberry:qnx_os_for_safety:2.1:4:*:*:*:*:*:* (cpe) Affected: 2.0.2 and earlier (custom) Affected: cpe:2.3:o:blackberry:qnx_os_for_safety:2.0:2:*:*:*:*:*:* (cpe) |
|
| BlackBerry Ltd. | QNX OS for Medical |
Affected:
2.0.1 and earlier
(custom)
Affected: cpe:2.3:o:blackberry:qnx_os_for_medical:2.0:1:*:*:*:*:*:* (cpe) |
Date Public
2026-01-13 16:25
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-8090",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-13T21:41:44.974623Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-01-13T21:41:51.831Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "QNX Software Development Platform",
"vendor": "BlackBerry Ltd",
"versions": [
{
"status": "affected",
"version": "7.1 and 7.0",
"versionType": "custom"
},
{
"status": "affected",
"version": "cpe:2.3:a:blackberry:qnx_software_development_platform:7.1:*:*:*:*:*:*:*",
"versionType": "cpe"
},
{
"status": "affected",
"version": "cpe:2.3:a:blackberry:qnx_software_development_platform:7.0:*:*:*:*:*:*:*",
"versionType": "cpe"
}
]
},
{
"defaultStatus": "unaffected",
"product": "QNX OS for Safety",
"vendor": "BlackBerry Ltd",
"versions": [
{
"status": "affected",
"version": "2.2.7 and earlier",
"versionType": "custom"
},
{
"status": "affected",
"version": "cpe:2.3:o:blackberry:qnx_os_for_safety:2.2:7:*:*:*:*:*:*",
"versionType": "cpe"
},
{
"status": "affected",
"version": "2.1.4 and earlier",
"versionType": "custom"
},
{
"status": "affected",
"version": "cpe:2.3:o:blackberry:qnx_os_for_safety:2.1:4:*:*:*:*:*:*",
"versionType": "cpe"
},
{
"status": "affected",
"version": "2.0.2 and earlier",
"versionType": "custom"
},
{
"status": "affected",
"version": "cpe:2.3:o:blackberry:qnx_os_for_safety:2.0:2:*:*:*:*:*:*",
"versionType": "cpe"
}
]
},
{
"defaultStatus": "unaffected",
"product": "QNX OS for Medical",
"vendor": "BlackBerry Ltd.",
"versions": [
{
"status": "affected",
"version": "2.0.1 and earlier",
"versionType": "custom"
},
{
"status": "affected",
"version": "cpe:2.3:o:blackberry:qnx_os_for_medical:2.0:1:*:*:*:*:*:*",
"versionType": "cpe"
}
]
}
],
"datePublic": "2026-01-13T16:25:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Null pointer dereference in the MsgRegisterEvent() system call could allow\u0026nbsp;an attacker with local access and code execution abilities to crash the\u0026nbsp;QNX Neutrino kernel."
}
],
"value": "Null pointer dereference in the MsgRegisterEvent() system call could allow\u00a0an attacker with local access and code execution abilities to crash the\u00a0QNX Neutrino kernel."
}
],
"impacts": [
{
"capecId": "CAPEC-129",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-129 Pointer Manipulation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-476",
"description": "CWE-476 NULL Pointer Dereference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-01-13T18:57:38.781Z",
"orgId": "dbe78b00-5e7b-4fda-8748-329789ecfc5c",
"shortName": "blackberry"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://support.blackberry.com/pkb/s/article/141027"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Vulnerability in the QNX Neutrino Kernel impacts the QNX Software Development Platform and QNX OS for Safety",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "dbe78b00-5e7b-4fda-8748-329789ecfc5c",
"assignerShortName": "blackberry",
"cveId": "CVE-2025-8090",
"datePublished": "2026-01-13T16:36:21.061Z",
"dateReserved": "2025-07-23T15:38:00.519Z",
"dateUpdated": "2026-01-13T21:41:51.831Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-4018 (GCVE-0-2026-4018)
Vulnerability from cvelistv5 – Published: 2026-07-14 17:34 – Updated: 2026-07-15 14:01
VLAI
EPSS
VEX
Title
TOCTOU race condition in the QNX Neutrino kernel impacts versions of the QNX Software Development Platform and QNX OS for Safety
Summary
TOCTOU Race Condition in specific trace commands of the TraceEvent() system call could allow an attacker with local access and with the PROCMGR_AID_TRACE ability, to cause information disclosure, data tampering or a crash of the QNX Neutrino kernel.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-367 - Time-of-check time-of-use (TOCTOU) race condition
Assigner
References
1 reference
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| BlackBerry Ltd | QNX Software Development Platform |
Affected:
7.1
Affected: cpe:2.3:a:blackberry:qnx_software_development_platform:7.1:*:*:*:*:*:*:* (cpe) Affected: 7.0 Affected: cpe:2.3:a:blackberry:qnx_software_development_platform:7.0:*:*:*:*:*:*:* (cpe) |
|
| BlackBerry Ltd | QNX OS for Safety |
Affected:
2.2.8 and earlier
Affected: cpe:2.3:o:blackberry:qnx_os_for_safety:2.2:8:*:*:*:*:*:* (cpe) Affected: 2.1.5 and earlier Affected: cpe:2.3:o:blackberry:qnx_os_for_safety:2.1:5:*:*:*:*:*:* (cpe) Affected: 2.0.3 and earlier Affected: cpe:2.3:o:blackberry:qnx_os_for_safety:2.0:3:*:*:*:*:*:* (cpe) |
|
| BlackBerry Ltd. | QNX OS for Medical |
Affected:
2.0.2 and earlier
Affected: cpe:2.3:o:blackberry:qnx_os_for_medical:2.0:2:*:*:*:*:*:* (cpe) |
Date Public
2026-07-14 15:20
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-4018",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-15T14:00:49.532095Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-15T14:01:13.318Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "QNX Software Development Platform",
"vendor": "BlackBerry Ltd",
"versions": [
{
"status": "affected",
"version": "7.1"
},
{
"status": "affected",
"version": "cpe:2.3:a:blackberry:qnx_software_development_platform:7.1:*:*:*:*:*:*:*",
"versionType": "cpe"
},
{
"status": "affected",
"version": "7.0"
},
{
"status": "affected",
"version": "cpe:2.3:a:blackberry:qnx_software_development_platform:7.0:*:*:*:*:*:*:*",
"versionType": "cpe"
}
]
},
{
"defaultStatus": "unaffected",
"product": "QNX OS for Safety",
"vendor": "BlackBerry Ltd",
"versions": [
{
"status": "affected",
"version": "2.2.8 and earlier"
},
{
"status": "affected",
"version": "cpe:2.3:o:blackberry:qnx_os_for_safety:2.2:8:*:*:*:*:*:*",
"versionType": "cpe"
},
{
"status": "affected",
"version": "2.1.5 and earlier"
},
{
"status": "affected",
"version": "cpe:2.3:o:blackberry:qnx_os_for_safety:2.1:5:*:*:*:*:*:*",
"versionType": "cpe"
},
{
"status": "affected",
"version": "2.0.3 and earlier"
},
{
"status": "affected",
"version": "cpe:2.3:o:blackberry:qnx_os_for_safety:2.0:3:*:*:*:*:*:*",
"versionType": "cpe"
}
]
},
{
"defaultStatus": "unaffected",
"product": "QNX OS for Medical",
"vendor": "BlackBerry Ltd.",
"versions": [
{
"status": "affected",
"version": "2.0.2 and earlier"
},
{
"status": "affected",
"version": "cpe:2.3:o:blackberry:qnx_os_for_medical:2.0:2:*:*:*:*:*:*",
"versionType": "cpe"
}
]
}
],
"datePublic": "2026-07-14T15:20:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "TOCTOU Race Condition in specific trace commands of the TraceEvent() system call could allow an attacker with local access and with the PROCMGR_AID_TRACE ability, to cause information disclosure, data tampering or a crash of the QNX Neutrino kernel."
}
],
"value": "TOCTOU Race Condition in specific trace commands of the TraceEvent() system call could allow an attacker with local access and with the PROCMGR_AID_TRACE ability, to cause information disclosure, data tampering or a crash of the QNX Neutrino kernel."
}
],
"impacts": [
{
"capecId": "CAPEC-29",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-29 Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-367",
"description": "CWE-367 Time-of-check time-of-use (TOCTOU) race condition",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T17:34:01.952Z",
"orgId": "dbe78b00-5e7b-4fda-8748-329789ecfc5c",
"shortName": "blackberry"
},
"references": [
{
"url": "https://support.blackberry.com/pkb/s/article/141213"
}
],
"source": {
"advisory": "https://support.blackberry.com/pkb/s/article/141213",
"discovery": "UNKNOWN"
},
"title": "TOCTOU race condition in the QNX Neutrino kernel impacts versions of the QNX Software Development Platform and QNX OS for Safety",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "dbe78b00-5e7b-4fda-8748-329789ecfc5c",
"assignerShortName": "blackberry",
"cveId": "CVE-2026-4018",
"datePublished": "2026-07-14T17:34:01.952Z",
"dateReserved": "2026-03-11T19:24:46.531Z",
"dateUpdated": "2026-07-15T14:01:13.318Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-4017 (GCVE-0-2026-4017)
Vulnerability from cvelistv5 – Published: 2026-07-14 17:25 – Updated: 2026-07-14 23:36
VLAI
EPSS
VEX
Title
Buffer overflow in the QNX Neutrino kernel impacts versions of the QNX Software Development Platform and QNX OS for Safety
Summary
Buffer Overflow in the entry handler of the TraceEvent() system call could allow an attacker with local access to cause information disclosure, data tampering or a crash of the QNX Neutrino kernel.
Severity
7.4 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-121 - Stack-based buffer overflow
Assigner
References
1 reference
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| BlackBerry Ltd | QNX Software Development Platform |
Affected:
7.1
Affected: cpe:2.3:a:blackberry:qnx_software_development_platform:7.1:*:*:*:*:*:*:* (cpe) Affected: 7.0 Affected: cpe:2.3:a:blackberry:qnx_software_development_platform:7.0:*:*:*:*:*:*:* (cpe) |
|
| BlackBerry Ltd | QNX OS for Safety |
Affected:
2.2.8 and earlier
Affected: cpe:2.3:o:blackberry:qnx_os_for_safety:2.2:8:*:*:*:*:*:* (cpe) Affected: 2.1.5 and earlier Affected: cpe:2.3:o:blackberry:qnx_os_for_safety:2.1:5:*:*:*:*:*:* (cpe) Affected: 2.0.3 and earlier Affected: cpe:2.3:o:blackberry:qnx_os_for_safety:2.0:3:*:*:*:*:*:* (cpe) |
|
| BlackBerry Ltd. | QNX OS for Medical |
Affected:
2.0.2 and earlier
Affected: cpe:2.3:o:blackberry:qnx_os_for_medical:2.0:2:*:*:*:*:*:* (cpe) |
Date Public
2026-07-14 15:15
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-4017",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-14T23:36:16.979515Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T23:36:28.181Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "QNX Software Development Platform",
"vendor": "BlackBerry Ltd",
"versions": [
{
"status": "affected",
"version": "7.1"
},
{
"status": "affected",
"version": "cpe:2.3:a:blackberry:qnx_software_development_platform:7.1:*:*:*:*:*:*:*",
"versionType": "cpe"
},
{
"status": "affected",
"version": "7.0"
},
{
"status": "affected",
"version": "cpe:2.3:a:blackberry:qnx_software_development_platform:7.0:*:*:*:*:*:*:*",
"versionType": "cpe"
}
]
},
{
"defaultStatus": "unaffected",
"product": "QNX OS for Safety",
"vendor": "BlackBerry Ltd",
"versions": [
{
"status": "affected",
"version": "2.2.8 and earlier"
},
{
"status": "affected",
"version": "cpe:2.3:o:blackberry:qnx_os_for_safety:2.2:8:*:*:*:*:*:*",
"versionType": "cpe"
},
{
"status": "affected",
"version": "2.1.5 and earlier"
},
{
"status": "affected",
"version": "cpe:2.3:o:blackberry:qnx_os_for_safety:2.1:5:*:*:*:*:*:*",
"versionType": "cpe"
},
{
"status": "affected",
"version": "2.0.3 and earlier"
},
{
"status": "affected",
"version": "cpe:2.3:o:blackberry:qnx_os_for_safety:2.0:3:*:*:*:*:*:*",
"versionType": "cpe"
}
]
},
{
"defaultStatus": "unaffected",
"product": "QNX OS for Medical",
"vendor": "BlackBerry Ltd.",
"versions": [
{
"status": "affected",
"version": "2.0.2 and earlier"
},
{
"status": "affected",
"version": "cpe:2.3:o:blackberry:qnx_os_for_medical:2.0:2:*:*:*:*:*:*",
"versionType": "cpe"
}
]
}
],
"datePublic": "2026-07-14T15:15:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Buffer Overflow in the entry handler of the TraceEvent() system call could allow an attacker with local access to cause information disclosure, data tampering or a crash of the QNX Neutrino kernel.\u0026nbsp;"
}
],
"value": "Buffer Overflow in the entry handler of the TraceEvent() system call could allow an attacker with local access to cause information disclosure, data tampering or a crash of the QNX Neutrino kernel."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121 Stack-based buffer overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T17:25:13.128Z",
"orgId": "dbe78b00-5e7b-4fda-8748-329789ecfc5c",
"shortName": "blackberry"
},
"references": [
{
"url": "https://support.blackberry.com/pkb/s/article/141213"
}
],
"source": {
"advisory": "https://support.blackberry.com/pkb/s/article/141213",
"discovery": "UNKNOWN"
},
"title": "Buffer overflow in the QNX Neutrino kernel impacts versions of the QNX Software Development Platform and QNX OS for Safety",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "dbe78b00-5e7b-4fda-8748-329789ecfc5c",
"assignerShortName": "blackberry",
"cveId": "CVE-2026-4017",
"datePublished": "2026-07-14T17:25:13.128Z",
"dateReserved": "2026-03-11T19:20:13.205Z",
"dateUpdated": "2026-07-14T23:36:28.181Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-0515 (GCVE-0-2026-0515)
Vulnerability from cvelistv5 – Published: 2026-07-14 17:13 – Updated: 2026-07-14 23:35
VLAI
EPSS
VEX
Title
Insufficient parameter validation in the QNX Neutrino kernel impacts versions of the QNX Software Development Platform and QNX OS for Safety
Summary
Insufficient Parameter Validation in the SchedGet() system call could allow an attacker with local access to cause a crash of the QNX Neutrino kernel.
Severity
6.2 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-233 - Improper handling of parameters
Assigner
References
1 reference
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| BlackBerry Ltd | QNX Software Development Platform |
Affected:
7.1
Affected: cpe:2.3:a:blackberry:qnx_software_development_platform:7.1:*:*:*:*:*:*:* (cpe) Affected: 7.0 Affected: cpe:2.3:a:blackberry:qnx_software_development_platform:7.0:*:*:*:*:*:*:* |
|
| BlackBerry Ltd | QNX OS for Safety |
Affected:
2.2.8 and earlier
Affected: cpe:2.3:o:blackberry:qnx_os_for_safety:2.2:8:*:*:*:*:*:* (cpe) Affected: 2.1.5 and earlier Affected: cpe:2.3:o:blackberry:qnx_os_for_safety:2.1:5:*:*:*:*:*:* (cpe) Affected: 2.0.3 and earlier Affected: cpe:2.3:o:blackberry:qnx_os_for_safety:2.0:3:*:*:*:*:*:* (cpe) |
|
| BlackBerry Ltd. | QNX OS for Medical |
Affected:
2.0.2 and earlier
Affected: cpe:2.3:o:blackberry:qnx_os_for_medical:2.0:2:*:*:*:*:*:* (cpe) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-0515",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-14T23:35:18.765970Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T23:35:27.900Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "QNX Software Development Platform",
"vendor": "BlackBerry Ltd",
"versions": [
{
"status": "affected",
"version": "7.1"
},
{
"status": "affected",
"version": "cpe:2.3:a:blackberry:qnx_software_development_platform:7.1:*:*:*:*:*:*:*",
"versionType": "cpe"
},
{
"status": "affected",
"version": "7.0"
},
{
"status": "affected",
"version": "cpe:2.3:a:blackberry:qnx_software_development_platform:7.0:*:*:*:*:*:*:*"
}
]
},
{
"defaultStatus": "unaffected",
"product": "QNX OS for Safety",
"vendor": "BlackBerry Ltd",
"versions": [
{
"status": "affected",
"version": "2.2.8 and earlier"
},
{
"status": "affected",
"version": "cpe:2.3:o:blackberry:qnx_os_for_safety:2.2:8:*:*:*:*:*:*",
"versionType": "cpe"
},
{
"status": "affected",
"version": "2.1.5 and earlier"
},
{
"status": "affected",
"version": "cpe:2.3:o:blackberry:qnx_os_for_safety:2.1:5:*:*:*:*:*:*",
"versionType": "cpe"
},
{
"status": "affected",
"version": "2.0.3 and earlier"
},
{
"status": "affected",
"version": "cpe:2.3:o:blackberry:qnx_os_for_safety:2.0:3:*:*:*:*:*:*",
"versionType": "cpe"
}
]
},
{
"defaultStatus": "unaffected",
"product": "QNX OS for Medical",
"vendor": "BlackBerry Ltd.",
"versions": [
{
"status": "affected",
"version": "2.0.2 and earlier"
},
{
"status": "affected",
"version": "cpe:2.3:o:blackberry:qnx_os_for_medical:2.0:2:*:*:*:*:*:*",
"versionType": "cpe"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Insufficient Parameter Validation in the SchedGet() system call could allow an attacker with local access to cause a crash of the QNX Neutrino kernel."
}
],
"value": "Insufficient Parameter Validation in the SchedGet() system call could allow an attacker with local access to cause a crash of the QNX Neutrino kernel."
}
],
"impacts": [
{
"capecId": "CAPEC-153",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-153 Input Data Manipulation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-233",
"description": "CWE-233 Improper handling of parameters",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T17:13:07.258Z",
"orgId": "dbe78b00-5e7b-4fda-8748-329789ecfc5c",
"shortName": "blackberry"
},
"references": [
{
"url": "https://support.blackberry.com/pkb/s/article/141213"
}
],
"source": {
"advisory": "https://support.blackberry.com/pkb/s/article/141213",
"discovery": "UNKNOWN"
},
"title": "Insufficient parameter validation in the QNX Neutrino kernel impacts versions of the QNX Software Development Platform and QNX OS for Safety",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "dbe78b00-5e7b-4fda-8748-329789ecfc5c",
"assignerShortName": "blackberry",
"cveId": "CVE-2026-0515",
"datePublished": "2026-07-14T17:13:07.258Z",
"dateReserved": "2025-12-10T15:04:59.507Z",
"dateUpdated": "2026-07-14T23:35:27.900Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-8090 (GCVE-0-2025-8090)
Vulnerability from cvelistv5 – Published: 2026-01-13 16:36 – Updated: 2026-01-13 21:41
VLAI
EPSS
VEX
Title
Vulnerability in the QNX Neutrino Kernel impacts the QNX Software Development Platform and QNX OS for Safety
Summary
Null pointer dereference in the MsgRegisterEvent() system call could allow an attacker with local access and code execution abilities to crash the QNX Neutrino kernel.
Severity
6.2 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-476 - NULL Pointer Dereference
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://support.blackberry.com/pkb/s/article/141027 | vendor-advisory |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| BlackBerry Ltd | QNX Software Development Platform |
Affected:
7.1 and 7.0
(custom)
Affected: cpe:2.3:a:blackberry:qnx_software_development_platform:7.1:*:*:*:*:*:*:* (cpe) Affected: cpe:2.3:a:blackberry:qnx_software_development_platform:7.0:*:*:*:*:*:*:* (cpe) |
|
| BlackBerry Ltd | QNX OS for Safety |
Affected:
2.2.7 and earlier
(custom)
Affected: cpe:2.3:o:blackberry:qnx_os_for_safety:2.2:7:*:*:*:*:*:* (cpe) Affected: 2.1.4 and earlier (custom) Affected: cpe:2.3:o:blackberry:qnx_os_for_safety:2.1:4:*:*:*:*:*:* (cpe) Affected: 2.0.2 and earlier (custom) Affected: cpe:2.3:o:blackberry:qnx_os_for_safety:2.0:2:*:*:*:*:*:* (cpe) |
|
| BlackBerry Ltd. | QNX OS for Medical |
Affected:
2.0.1 and earlier
(custom)
Affected: cpe:2.3:o:blackberry:qnx_os_for_medical:2.0:1:*:*:*:*:*:* (cpe) |
Date Public
2026-01-13 16:25
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-8090",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-13T21:41:44.974623Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-01-13T21:41:51.831Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "QNX Software Development Platform",
"vendor": "BlackBerry Ltd",
"versions": [
{
"status": "affected",
"version": "7.1 and 7.0",
"versionType": "custom"
},
{
"status": "affected",
"version": "cpe:2.3:a:blackberry:qnx_software_development_platform:7.1:*:*:*:*:*:*:*",
"versionType": "cpe"
},
{
"status": "affected",
"version": "cpe:2.3:a:blackberry:qnx_software_development_platform:7.0:*:*:*:*:*:*:*",
"versionType": "cpe"
}
]
},
{
"defaultStatus": "unaffected",
"product": "QNX OS for Safety",
"vendor": "BlackBerry Ltd",
"versions": [
{
"status": "affected",
"version": "2.2.7 and earlier",
"versionType": "custom"
},
{
"status": "affected",
"version": "cpe:2.3:o:blackberry:qnx_os_for_safety:2.2:7:*:*:*:*:*:*",
"versionType": "cpe"
},
{
"status": "affected",
"version": "2.1.4 and earlier",
"versionType": "custom"
},
{
"status": "affected",
"version": "cpe:2.3:o:blackberry:qnx_os_for_safety:2.1:4:*:*:*:*:*:*",
"versionType": "cpe"
},
{
"status": "affected",
"version": "2.0.2 and earlier",
"versionType": "custom"
},
{
"status": "affected",
"version": "cpe:2.3:o:blackberry:qnx_os_for_safety:2.0:2:*:*:*:*:*:*",
"versionType": "cpe"
}
]
},
{
"defaultStatus": "unaffected",
"product": "QNX OS for Medical",
"vendor": "BlackBerry Ltd.",
"versions": [
{
"status": "affected",
"version": "2.0.1 and earlier",
"versionType": "custom"
},
{
"status": "affected",
"version": "cpe:2.3:o:blackberry:qnx_os_for_medical:2.0:1:*:*:*:*:*:*",
"versionType": "cpe"
}
]
}
],
"datePublic": "2026-01-13T16:25:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Null pointer dereference in the MsgRegisterEvent() system call could allow\u0026nbsp;an attacker with local access and code execution abilities to crash the\u0026nbsp;QNX Neutrino kernel."
}
],
"value": "Null pointer dereference in the MsgRegisterEvent() system call could allow\u00a0an attacker with local access and code execution abilities to crash the\u00a0QNX Neutrino kernel."
}
],
"impacts": [
{
"capecId": "CAPEC-129",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-129 Pointer Manipulation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-476",
"description": "CWE-476 NULL Pointer Dereference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-01-13T18:57:38.781Z",
"orgId": "dbe78b00-5e7b-4fda-8748-329789ecfc5c",
"shortName": "blackberry"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://support.blackberry.com/pkb/s/article/141027"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Vulnerability in the QNX Neutrino Kernel impacts the QNX Software Development Platform and QNX OS for Safety",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "dbe78b00-5e7b-4fda-8748-329789ecfc5c",
"assignerShortName": "blackberry",
"cveId": "CVE-2025-8090",
"datePublished": "2026-01-13T16:36:21.061Z",
"dateReserved": "2025-07-23T15:38:00.519Z",
"dateUpdated": "2026-01-13T21:41:51.831Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}