{"id":"CVE-2026-40275","kind":"vulnerability","aliases":["CVE-2026-40275"],"related":[],"title":"QNX Neutrino kernel: heap overflow in procnto event handler, local access","description":"Heap-based Buffer Overflow in the DCMD_PROC_EVENT handler of the procnto could allow an attacker with local access to cause an information disclosure, data tampering or a crash of the QNX Neutrino kernel.","summary":"Heap-based buffer overflow in the DCMD_PROC_EVENT handler of procnto (QNX Neutrino kernel). Needs local access and the ability to run code on the target. Can lead to information disclosure, data tampering or a kernel crash. QNX knows of no exploitation; no mitigations or workarounds exist, so updating is the only remedy.","severity":"high","cvss":8.4,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"QNX Software Development Platform","fixed":["7.0.7279.L202606250527 (microkernel.core)","7.1: microkernel.core 1.4.0.03284T202606300813L"],"affected":"7.0, 7.1","ecosystem":"vendor"},{"name":"QNX OS for Safety","fixed":["2.2.10","2.1.7","2.0.5"],"affected":"<= 2.2.9, <= 2.1.6, <= 2.0.4","ecosystem":"vendor"},{"name":"QNX OS for Medical","fixed":["2.0.4"],"affected":"<= 2.0.3","ecosystem":"vendor"}],"ecosystems":[],"tags":["embedded","infrastructure","local-access","qnx","qnx-os-for-medical","qnx-os-for-safety","qnx-sdp","rtos"],"not_affected_if":["no-local-access","no-local-code-execution"],"how_to_check":"List installed QNX Software Center packages and compare the microkernel.core (or qos.group) package version against the fixed ones in advisory QNX-2026-005. Affected: SDP 7.1 and 7.0, QNX OS for Safety 2.2.9/2.1.6/2.0.4 and earlier, QNX OS for Medical 2.0.3 and earlier. Also check any SDP 8.0 build older than 8.0.5; the advisory lists a fix there but does not name 8.0 as affected.","fix":"Install the updated microkernel package from QNX Software Center (myQNX login): SDP 7.1 com.qnx.qnx710.target.microkernel.core 1.4.0.03284T202606300813L; SDP 7.0 com.qnx.sdp.target.microkernel.core 7.0.7279.L202606250527; QNX OS for Safety 2.2.10, 2.1.7, 2.0.5; QNX OS for Medical 2.0.4. Also listed: SDP 8.0.5 (microkernel.core 2.6.0.00145T202606051700L), QNX OS for Safety 8.0.4.","status":"open","published_at":"2026-11-10T19:21:16+00:00","first_seen_at":"2026-11-10T19:25:15+00:00","triaged_at":"2026-11-10T19:34:24+00:00","updated_at":"2026-11-10T21:24:52+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-11-10T19:34:24Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"QNX Neutrino kernel: heap overflow in procnto event handler, local access","impact":"high","summary":"A heap-based buffer overflow in the DCMD_PROC_EVENT handler of procnto, the QNX Neutrino kernel process, can be triggered by a local attacker. The flaw can lead to information disclosure, data tampering, or a kernel crash.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["qnx","embedded","rtos"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"kernel crash, data tampering or information disclosure on the device","analyst_note":"Find affected QNX Neutrino versions and the vendor fixed release from QNX advisories; NVD page lists no product ranges.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-local-access"],"who_is_affected":"Only systems running QNX Neutrino where a local attacker can run code or send requests to the procnto kernel process. Systems without local untrusted access are lower risk. The sources do not name affected versions.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000678,"input_tokens":4538,"output_tokens":449,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find affected QNX Neutrino versions and the vendor fixed release from QNX advisories; NVD page lists no product ranges.","search":"'-2026':13A,16A '-40275':14A,17A 'abil':71B 'access':11A,34B,68B,125C 'allow':120C 'attack':122C 'base':52B,107C 'buffer':53B,108C 'caus':127C 'code':74B 'could':119C 'crash':88B,135C 'cve':12A,15A 'data':83B,131C 'dcmd':57B,112C 'development':20A 'disclosur':82B,130C 'embed':30B 'event':8A,59B,114C 'exist':98B 'exploit':93B 'for':24A,28A 'handler':9A,60B,115C 'heap':4A,51B,106C 'heap-bas':50B,105C 'inform':81B,129C 'infrastructur':31B 'kernel':3A,65B,87B,140C 'know':90B 'lead':79B 'local':10A,33B,67B,124C 'local-access':32B 'medic':40B 'medical':29A 'mitig':95B 'need':66B 'neutrino':2A,64B,139C 'os':23A,27A,38B,43B 'overflow':5A,54B,109C 'platform':21A 'proc':58B,113C 'procnto':7A,62B,118C 'qnx':1A,18A,22A,26A,35B,37B,42B,47B,63B,89B,138C 'qnx-os-for-med':36B 'qnx-os-for-safeti':41B 'qnx-sdp':46B 'remedi':104B 'rtos':49B 'run':73B 'safeti':45B 'safety':25A 'sdp':48B 'software':19A 'tamper':84B,132C 'target':77B 'updat':100B 'workaround':97B","nicknames":[],"mitigations":[],"who_affected":"Only systems running QNX Neutrino where a local attacker can run code or send requests to the procnto kernel process. Systems without local untrusted access are lower risk. The sources do not name affected versions.","tier":"B","verified":{"fix":{"at":"2026-11-10T21:24:52Z","by":"analyst","doc":"https://support.blackberry.com/pkb/s/article/141342","run_id":2787},"products":{"at":"2026-11-10T21:24:52Z","by":"analyst","doc":"https://support.blackberry.com/pkb/s/article/141342","run_id":2787},"mitigations":{"at":"2026-11-10T21:24:52Z","by":"analyst","doc":"https://support.blackberry.com/pkb/s/article/141342","run_id":2787},"workarounds":{"at":"2026-11-10T21:24:52Z","by":"analyst","doc":"https://support.blackberry.com/pkb/s/article/141342","run_id":2787},"how_to_check":{"at":"2026-11-10T21:24:52Z","by":"analyst","doc":"https://support.blackberry.com/pkb/s/article/141342","run_id":2787}},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["osformedical","osforsafety","qnxosformedical","qnxosforsafety","qnxsoftwaredevelopmentplatform","softwaredevelopmentplatform"],"ptokens":["development","for","medical","os","platform","qnx","safety","software"],"labels":["embedded","high","infrastructure","localaccess","qnx","qnxosformedical","qnxosforsafety","qnxsdp","rtos"],"campaign_type":null,"search_a":"'-2026':13A,16A '-40275':14A,17A 'access':11A 'cve':12A,15A 'development':20A 'event':8A 'for':24A,28A 'handler':9A 'heap':4A 'kernel':3A 'local':10A 'medical':29A 'neutrino':2A 'os':23A,27A 'overflow':5A 'platform':21A 'procnto':7A 'qnx':1A,18A,22A,26A 'safety':25A 'software':19A","search_b":"'abil':71B 'access':34B,68B 'base':52B 'buffer':53B 'code':74B 'crash':88B 'data':83B 'dcmd':57B 'disclosur':82B 'embed':30B 'event':59B 'exist':98B 'exploit':93B 'handler':60B 'heap':51B 'heap-bas':50B 'inform':81B 'infrastructur':31B 'kernel':65B,87B 'know':90B 'lead':79B 'local':33B,67B 'local-access':32B 'medic':40B 'mitig':95B 'need':66B 'neutrino':64B 'os':38B,43B 'overflow':54B 'proc':58B 'procnto':62B 'qnx':35B,37B,42B,47B,63B,89B 'qnx-os-for-med':36B 'qnx-os-for-safeti':41B 'qnx-sdp':46B 'remedi':104B 'rtos':49B 'run':73B 'safeti':45B 'sdp':48B 'tamper':84B 'target':77B 'updat':100B 'workaround':97B","search_c":"'access':125C 'allow':120C 'attack':122C 'base':107C 'buffer':108C 'caus':127C 'could':119C 'crash':135C 'data':131C 'dcmd':112C 'disclosur':130C 'event':114C 'handler':115C 'heap':106C 'heap-bas':105C 'inform':129C 'kernel':140C 'local':124C 'neutrino':139C 'overflow':109C 'proc':113C 'procnto':118C 'qnx':138C 'tamper':132C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:21:16+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@blackberry.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-40275","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40275","severity":null,"published_at":"2026-11-10T19:21:16+00:00","modified_at":"2026-11-10T19:21:16+00:00","first_seen_at":"2026-11-10T19:25:15+00:00","fetched_at":"2026-11-10T19:25:15+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-40275:2787","url":"https://support.blackberry.com/pkb/s/article/141342","severity":null,"published_at":"2026-11-10T21:24:52+00:00","modified_at":"2026-11-10T21:24:52+00:00","first_seen_at":"2026-11-10T21:24:52+00:00","fetched_at":"2026-11-10T21:24:52+00:00","note":"Read QNX-2026-005 (NOT1090) on BlackBerry support: affected versions, fixed packages, no mitigations/workarounds, no known exploitation. Advisory does not state whether SDP 8.0 before 8.0.5 is affected.","cites":["https://support.blackberry.com/pkb/s/article/141342"]}],"documents":[{"id":118850,"url":"https://support.blackberry.com/pkb/s/article/141342","title":"QNX-2026-005 Vulnerabilities in the QNX Neutrino kernel (NOT1090)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}