{"id":"CVE-2026-50077","kind":"vulnerability","aliases":["CVE-2026-50077"],"related":[],"title":"QNX Hypervisor: guest can corrupt memory in QVM via MSI-X table (CVE-2026-50077)","description":"Invalid Memory Access via the MSI-X table in QVM could allow an attacker in the guest to execute arbitrary code in the QVM to cause memory corruption, information disclosure or a crash of the QVM.","summary":"BlackBerry QNX advisory QNX-2026-006: invalid memory access through the MSI-X table in the QNX Virtual Machine (QVM) lets a privileged attacker in a guest cause memory corruption, information disclosure or a QVM crash (CVSS 7.7, CWE-787). QNX is not aware of exploitation; no mitigations or workarounds exist, only the update.","severity":"high","cvss":7.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"QNX Hypervisor","fixed":["8.0.4 Update 2","2.2.10","2.0.9"],"affected":"<= 8.0.4 Update 1; <= 2.2.9; <= 2.0.8","ecosystem":"vendor"},{"name":"QNX Hypervisor for Safety","fixed":["8.0.4 Update 2","2.2.11","2.0.3"],"affected":"<= 8.0.4 Update 1; <= 2.2.10; <= 2.0.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["embedded","guest-escape","hypervisor","infrastructure","local","qnx","qvm","virtualization"],"not_affected_if":["no-qnx-hypervisor","no-untrusted-guest-code"],"how_to_check":"Check whether you run QNX Hypervisor or QNX Hypervisor for Safety (QVM / qvm processes hosting guests) and compare the installed version against the affected list: 8.0.4 Update 1 and earlier, 2.2.9 and earlier (Hypervisor), 2.2.10 and earlier (for Safety), 2.0.8 and earlier (Hypervisor), 2.0.2 and earlier (for Safety). QNX SDP and QNX OS for Safety alone are listed as non-affected.","fix":"Update via QNX Software Center (myQNX login): QNX Hypervisor 8.0.4 Update 2 or 2.2.10 or 2.0.9; QNX Hypervisor for Safety 8.0.4 Update 2 or 2.2.11 or 2.0.3. Package versions are listed in QNX-2026-006.","status":"open","published_at":"2026-11-10T20:19:12+00:00","first_seen_at":"2026-11-10T20:46:04+00:00","triaged_at":"2026-11-10T20:47:39+00:00","updated_at":"2026-11-10T20:54:32+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-11-10T20:47:39Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"QVM: invalid memory access via MSI-X table lets guest run code","impact":"high","summary":"QVM, the virtualization component, mishandles memory access through its MSI-X table, so a guest can corrupt memory in the QVM, read information, or crash it. An attacker inside the guest could execute arbitrary code in the QVM.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["qvm","virtualization"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker in guest runs code inside the hypervisor component","analyst_note":"Identify the affected QVM product, versions and fixed release from the NVD entry and vendor advisory; sources give no product ranges.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000634,"input_tokens":4528,"output_tokens":362,"severity_before":"high"},"analyst_status":"done","analyst_note":"Identify the affected QVM product, versions and fixed release from the NVD entry and vendor advisory; sources give no product ranges.","search":"'-006':44B '-2026':15A,18A,21A,43B '-50077':16A,19A,22A '-787':79B '7.7':77B 'access':47B,96C 'advisori':41B 'allow':106C 'arbitrari':114C 'attack':63B,108C 'awar':83B 'blackberri':39B 'caus':67B,120C 'code':115C 'corrupt':5A,69B,122C 'could':105C 'crash':75B,127C 'cve':14A,17A,20A 'cvss':76B 'cwe':78B 'disclosur':71B,124C 'embed':29B 'escap':32B 'execut':113C 'exist':90B 'exploit':85B 'for':27A 'guest':3A,31B,66B,111C 'guest-escap':30B 'hypervisor':2A,24A,26A,33B 'inform':70B,123C 'infrastructur':34B 'invalid':45B,94C 'let':60B 'local':35B 'machin':58B 'memori':6A,46B,68B,95C,121C 'mitig':87B 'msi':11A,51B,100C 'msi-x':10A,50B,99C 'privileg':62B 'qnx':1A,23A,25A,36B,40B,42B,56B,80B 'qvm':8A,37B,59B,74B,104C,118C,130C 'safety':28A 'tabl':13A,53B,102C 'updat':93B 'via':9A,97C 'virtual':38B,57B 'workaround':89B 'x':12A,52B,101C","nicknames":[],"mitigations":[],"who_affected":"Systems running QNX Hypervisor or QNX Hypervisor for Safety, where a guest VM could run untrusted or compromised code. The attacker must already run code in the guest with enough privilege to manipulate the MSI-X table, and QNX rates complexity high. Teams without QNX hypervisor guests can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-10T20:54:32Z","by":"analyst","doc":"https://support.blackberry.com/pkb/s/article/141343","run_id":2722},"products":{"at":"2026-11-10T20:54:32Z","by":"analyst","doc":"https://support.blackberry.com/pkb/s/article/141343","run_id":2722},"mitigations":{"at":"2026-11-10T20:54:32Z","by":"analyst","doc":"https://support.blackberry.com/pkb/s/article/141343","run_id":2722},"workarounds":{"at":"2026-11-10T20:54:32Z","by":"analyst","doc":"https://support.blackberry.com/pkb/s/article/141343","run_id":2722}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["hypervisor","hypervisorforsafety","qnxhypervisor","qnxhypervisorforsafety"],"ptokens":["for","hypervisor","qnx","safety"],"labels":["embedded","guestescape","high","hypervisor","infrastructure","local","qnx","qvm","virtualization"],"campaign_type":null,"search_a":"'-2026':15A,18A,21A '-50077':16A,19A,22A 'corrupt':5A 'cve':14A,17A,20A 'for':27A 'guest':3A 'hypervisor':2A,24A,26A 'memori':6A 'msi':11A 'msi-x':10A 'qnx':1A,23A,25A 'qvm':8A 'safety':28A 'tabl':13A 'via':9A 'x':12A","search_b":"'-006':44B '-2026':43B '-787':79B '7.7':77B 'access':47B 'advisori':41B 'attack':63B 'awar':83B 'blackberri':39B 'caus':67B 'corrupt':69B 'crash':75B 'cvss':76B 'cwe':78B 'disclosur':71B 'embed':29B 'escap':32B 'exist':90B 'exploit':85B 'guest':31B,66B 'guest-escap':30B 'hypervisor':33B 'inform':70B 'infrastructur':34B 'invalid':45B 'let':60B 'local':35B 'machin':58B 'memori':46B,68B 'mitig':87B 'msi':51B 'msi-x':50B 'privileg':62B 'qnx':36B,40B,42B,56B,80B 'qvm':37B,59B,74B 'tabl':53B 'updat':93B 'virtual':38B,57B 'workaround':89B 'x':52B","search_c":"'access':96C 'allow':106C 'arbitrari':114C 'attack':108C 'caus':120C 'code':115C 'corrupt':122C 'could':105C 'crash':127C 'disclosur':124C 'execut':113C 'guest':111C 'inform':123C 'invalid':94C 'memori':95C,121C 'msi':100C 'msi-x':99C 'qvm':104C,118C,130C 'tabl':102C 'via':97C 'x':101C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T20:19:12+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L","cvss_by":"secure@blackberry.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-50077","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50077","severity":null,"published_at":"2026-11-10T20:19:12+00:00","modified_at":"2026-11-10T20:19:12+00:00","first_seen_at":"2026-11-10T20:46:04+00:00","fetched_at":"2026-11-10T20:46:04+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-50077:2722","url":"https://support.blackberry.com/pkb/s/article/141343","severity":null,"published_at":"2026-11-10T20:54:32+00:00","modified_at":"2026-11-10T20:54:32+00:00","first_seen_at":"2026-11-10T20:54:32+00:00","fetched_at":"2026-11-10T20:54:32+00:00","note":"Read QNX-2026-006 (BlackBerry, 2026-11-10): versions, fixes, no mitigations/workarounds, no known exploitation. Advisory table merges columns, so the attacker-requirement mapping to this CVE is inferred (MSI-X table privileges); how-to-check and who-affected left unverified.","cites":["https://support.blackberry.com/pkb/s/article/141343"]}],"documents":[{"id":118327,"url":"https://support.blackberry.com/pkb/s/article/141343","title":"QNX-2026-006 Vulnerabilities in the QNX Virtual Machine (QVM) (NOT1091)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}