---
id: "CVE-2026-40275"
page: "https://infrastack.ai/live/CVE-2026-40275"
kind: "vulnerability"
aliases: ["CVE-2026-40275"]
title: "QNX Neutrino kernel: heap overflow in procnto event handler, local access"
severity: "high"
cvss: 8.4
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "QNX Software Development Platform", "fixed": ["7.0.7279.L202606250527 (microkernel.core)", "7.1: microkernel.core 1.4.0.03284T202606300813L"], "affected": "7.0, 7.1", "ecosystem": "vendor"}, {"name": "QNX OS for Safety", "fixed": ["2.2.10", "2.1.7", "2.0.5"], "affected": "<= 2.2.9, <= 2.1.6, <= 2.0.4", "ecosystem": "vendor"}, {"name": "QNX OS for Medical", "fixed": ["2.0.4"], "affected": "<= 2.0.3", "ecosystem": "vendor"}]
ecosystems: []
tags: ["embedded", "infrastructure", "local-access", "qnx", "qnx-os-for-medical", "qnx-os-for-safety", "qnx-sdp", "rtos"]
not_affected_if: ["no-local-access", "no-local-code-execution"]
published_at: "2026-11-10T19:21:16+00:00"
first_seen_at: "2026-11-10T19:25:15+00:00"
updated_at: "2026-11-10T21:24:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40275", "first_seen_at": "2026-11-10T19:25:15+00:00"}, {"source": "analyst", "url": "https://support.blackberry.com/pkb/s/article/141342", "first_seen_at": "2026-11-10T21:24:52+00:00", "cites": ["https://support.blackberry.com/pkb/s/article/141342"]}]
exploit_sources: []
---

# QNX Neutrino kernel: heap overflow in procnto event handler, local access

Link for people: https://infrastack.ai/live/CVE-2026-40275 (this .md is for agents)

Heap-based buffer overflow in the DCMD_PROC_EVENT handler of procnto (QNX Neutrino kernel). Needs local access and the ability to run code on the target. Can lead to information disclosure, data tampering or a kernel crash. QNX knows of no exploitation; no mitigations or workarounds exist, so updating is the only remedy.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:QNX Software Development Platform affected 7.0, 7.1 fixed 7.0.7279.L202606250527 (microkernel.core), 7.1: microkernel.core 1.4.0.03284T202606300813L
- vendor:QNX OS for Safety affected <= 2.2.9, <= 2.1.6, <= 2.0.4 fixed 2.2.10, 2.1.7, 2.0.5
- vendor:QNX OS for Medical affected <= 2.0.3 fixed 2.0.4

## How to check

List installed QNX Software Center packages and compare the microkernel.core (or qos.group) package version against the fixed ones in advisory QNX-2026-005. Affected: SDP 7.1 and 7.0, QNX OS for Safety 2.2.9/2.1.6/2.0.4 and earlier, QNX OS for Medical 2.0.3 and earlier. Also check any SDP 8.0 build older than 8.0.5; the advisory lists a fix there but does not name 8.0 as affected.

## Fix

Install the updated microkernel package from QNX Software Center (myQNX login): SDP 7.1 com.qnx.qnx710.target.microkernel.core 1.4.0.03284T202606300813L; SDP 7.0 com.qnx.sdp.target.microkernel.core 7.0.7279.L202606250527; QNX OS for Safety 2.2.10, 2.1.7, 2.0.5; QNX OS for Medical 2.0.4. Also listed: SDP 8.0.5 (microkernel.core 2.6.0.00145T202606051700L), QNX OS for Safety 8.0.4.

## Timeline

- 2026-11-10T19:25:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-40275
- 2026-11-10T21:24:52+00:00 analyst https://support.blackberry.com/pkb/s/article/141342 — Read QNX-2026-005 (NOT1090) on BlackBerry support: affected versions, fixed packages, no mitigations/workarounds, no known exploitation. Advisory does not state whether SDP 8.0 before 8.0.5 is affected.

## Documents

- [advisory] QNX-2026-005 Vulnerabilities in the QNX Neutrino kernel (NOT1090) https://support.blackberry.com/pkb/s/article/141342

## From the sources

Heap-based Buffer Overflow in the DCMD_PROC_EVENT handler of the procnto could allow an attacker with local access to cause an information disclosure, data tampering or a crash of the QNX Neutrino kernel.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_