---
id: "CVE-2026-50077"
page: "https://infrastack.ai/live/CVE-2026-50077"
kind: "vulnerability"
aliases: ["CVE-2026-50077"]
title: "QNX Hypervisor: guest can corrupt memory in QVM via MSI-X table (CVE-2026-50077)"
severity: "high"
cvss: 7.7
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "QNX Hypervisor", "fixed": ["8.0.4 Update 2", "2.2.10", "2.0.9"], "affected": "<= 8.0.4 Update 1; <= 2.2.9; <= 2.0.8", "ecosystem": "vendor"}, {"name": "QNX Hypervisor for Safety", "fixed": ["8.0.4 Update 2", "2.2.11", "2.0.3"], "affected": "<= 8.0.4 Update 1; <= 2.2.10; <= 2.0.2", "ecosystem": "vendor"}]
ecosystems: []
tags: ["embedded", "guest-escape", "hypervisor", "infrastructure", "local", "qnx", "qvm", "virtualization"]
not_affected_if: ["no-qnx-hypervisor", "no-untrusted-guest-code"]
published_at: "2026-11-10T20:19:12+00:00"
first_seen_at: "2026-11-10T20:46:04+00:00"
updated_at: "2026-11-10T20:54:32+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50077", "first_seen_at": "2026-11-10T20:46:04+00:00"}, {"source": "analyst", "url": "https://support.blackberry.com/pkb/s/article/141343", "first_seen_at": "2026-11-10T20:54:32+00:00", "cites": ["https://support.blackberry.com/pkb/s/article/141343"]}]
exploit_sources: []
---

# QNX Hypervisor: guest can corrupt memory in QVM via MSI-X table (CVE-2026-50077)

Link for people: https://infrastack.ai/live/CVE-2026-50077 (this .md is for agents)

BlackBerry QNX advisory QNX-2026-006: invalid memory access through the MSI-X table in the QNX Virtual Machine (QVM) lets a privileged attacker in a guest cause memory corruption, information disclosure or a QVM crash (CVSS 7.7, CWE-787). QNX is not aware of exploitation; no mitigations or workarounds exist, only the update.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:QNX Hypervisor affected <= 8.0.4 Update 1; <= 2.2.9; <= 2.0.8 fixed 8.0.4 Update 2, 2.2.10, 2.0.9
- vendor:QNX Hypervisor for Safety affected <= 8.0.4 Update 1; <= 2.2.10; <= 2.0.2 fixed 8.0.4 Update 2, 2.2.11, 2.0.3

## How to check

Check whether you run QNX Hypervisor or QNX Hypervisor for Safety (QVM / qvm processes hosting guests) and compare the installed version against the affected list: 8.0.4 Update 1 and earlier, 2.2.9 and earlier (Hypervisor), 2.2.10 and earlier (for Safety), 2.0.8 and earlier (Hypervisor), 2.0.2 and earlier (for Safety). QNX SDP and QNX OS for Safety alone are listed as non-affected.

## Fix

Update via QNX Software Center (myQNX login): QNX Hypervisor 8.0.4 Update 2 or 2.2.10 or 2.0.9; QNX Hypervisor for Safety 8.0.4 Update 2 or 2.2.11 or 2.0.3. Package versions are listed in QNX-2026-006.

## Timeline

- 2026-11-10T20:46:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-50077
- 2026-11-10T20:54:32+00:00 analyst https://support.blackberry.com/pkb/s/article/141343 — Read QNX-2026-006 (BlackBerry, 2026-11-10): versions, fixes, no mitigations/workarounds, no known exploitation. Advisory table merges columns, so the attacker-requirement mapping to this CVE is inferred (MSI-X table privileges); how-to-check and who-affected left unverified.

## Documents

- [advisory] QNX-2026-006 Vulnerabilities in the QNX Virtual Machine (QVM) (NOT1091) https://support.blackberry.com/pkb/s/article/141343

## From the sources

Invalid Memory Access via the MSI-X table in QVM could allow an attacker in the guest to execute arbitrary code in the QVM to cause memory corruption, information disclosure or a crash of the QVM.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_