CVE-2026-4017
HighCVSS 7.4Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
A buffer overflow vulnerability in the entry handler of the TraceEvent() system call could allow a local attacker to cause information disclosure, data tampering, or a crash of the QNX Neutrino kernel.
Risk Assessment
A local attacker could exploit this vulnerability to escalate privileges, steal sensitive data, or destabilize the system, posing a serious threat to the integrity and availability of embedded and critical systems.
Recommendation
Immediately apply the patch provided by BlackBerry for QNX Neutrino and restrict local system access to trusted users only.
Other vulnerabilities in QNX Neutrino
See all- CVE-2026-4018Medium
A TOCTOU race condition in specific trace commands of the TraceEvent() system call allows an attacker with local access and the PROCMGR_AID_TRACE ability to cause information disclosure, data tampering, or a crash of the QNX Neutrino kernel.
- CVE-2026-0515Medium
A vulnerability in the SchedGet() system call of the QNX Neutrino kernel is caused by insufficient parameter validation. A local attacker could exploit this flaw to crash the kernel.
Original NVD description (English source)
Buffer Overflow in the entry handler of the TraceEvent() system call could allow an attacker with local access to cause information disclosure, data tampering or a crash of the QNX Neutrino kernel.