CVE-2026-4018
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
A TOCTOU race condition in specific trace commands of the TraceEvent() system call allows an attacker with local access and the PROCMGR_AID_TRACE ability to cause information disclosure, data tampering, or a crash of the QNX Neutrino kernel.
Risk Assessment
The organization is at risk of sensitive data leakage, unauthorized modification of critical system information, and potential service disruptions due to kernel crashes.
Recommendation
Apply the security patch provided by QNX immediately and restrict local access and the PROCMGR_AID_TRACE privilege to trusted users only.
Other vulnerabilities in QNX Neutrino
See all- CVE-2026-4017High
A buffer overflow vulnerability in the entry handler of the TraceEvent() system call could allow a local attacker to cause information disclosure, data tampering, or a crash of the QNX Neutrino kernel.
- CVE-2026-0515Medium
A vulnerability in the SchedGet() system call of the QNX Neutrino kernel is caused by insufficient parameter validation. A local attacker could exploit this flaw to crash the kernel.
Original NVD description (English source)
TOCTOU Race Condition in specific trace commands of the TraceEvent() system call could allow an attacker with local access and with the PROCMGR_AID_TRACE ability, to cause information disclosure, data tampering or a crash of the QNX Neutrino kernel.