{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-40274","assignerOrgId":"dbe78b00-5e7b-4fda-8748-329789ecfc5c","state":"PUBLISHED","assignerShortName":"blackberry","dateReserved":"2026-04-10T17:41:10.441Z","datePublished":"2026-11-10T19:03:42.088Z","dateUpdated":"2026-11-10T19:03:42.088Z"},"containers":{"cna":{"providerMetadata":{"orgId":"dbe78b00-5e7b-4fda-8748-329789ecfc5c","shortName":"blackberry","dateUpdated":"2026-11-10T19:03:42.088Z"},"title":"Vulnerabilities in the QNX Neutrino kernel affect QNX Software Development Platform and QNX OS for Safety","datePublic":"2026-11-10T17:15:00.000Z","problemTypes":[{"descriptions":[{"lang":"en","cweId":"CWE-822","description":"CWE-822 Untrusted pointer dereference","type":"CWE"}]}],"impacts":[{"capecId":"CAPEC-129","descriptions":[{"lang":"en","value":"CAPEC-129 Pointer Manipulation"}]}],"affected":[{"vendor":"BlackBerry Ltd","product":"QNX Software Development Platform (SDP)","versions":[{"status":"affected","version":"cpe:2.3:a:blackberry:qnx_software_development_platform:7.1:*:*:*:*:*:*:*","versionType":"cpe"},{"status":"affected","version":"cpe:2.3:a:blackberry:qnx_software_development_platform:7.0:*:*:*:*:*:*:*","versionType":"cpe"}],"defaultStatus":"unaffected"},{"vendor":"BlackBerry Ltd","product":"QNX OS for Safety","versions":[{"status":"affected","version":"cpe:2.3:o:blackberry:qnx_os_for_safety:2.2:9:*:*:*:*:*:*","versionType":"cpe"},{"status":"affected","version":"cpe:2.3:o:blackberry:qnx_os_for_safety:2.1:6:*:*:*:*:*:*","versionType":"cpe"},{"status":"affected","version":"cpe:2.3:o:blackberry:qnx_os_for_safety:2.0:4:*:*:*:*:*:*","versionType":"cpe"}],"defaultStatus":"unaffected"},{"vendor":"BlackBerry Ltd","product":"QNX OS for Medical","versions":[{"status":"affected","version":"cpe:2.3:o:blackberry:qnx_os_for_medical:2.0:3:*:*:*:*:*:*","versionType":"cpe"}],"defaultStatus":"unaffected"}],"descriptions":[{"lang":"en","value":"Invalid Pointer Reference in the TimerSettime() system call could allow an attacker with local access to arm a crafted timer event which can cause an information disclosure in the QNX Neutrino kernel.","supportingMedia":[{"type":"text/html","base64":false,"value":"Invalid Pointer Reference in the TimerSettime() system call could allow an attacker with local access to arm a crafted timer event which can cause an information disclosure in the QNX Neutrino kernel. "}]}],"references":[{"url":"https://support.blackberry.com/pkb/s/article/141342"}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE","baseSeverity":"MEDIUM","baseScore":4,"vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 1.0.5"}}}}