CVE-2026-4018 | THREATINT

Description

TOCTOU Race Condition in specific trace commands of the TraceEvent() system call could allow an attacker with local access and with the PROCMGR_AID_TRACE ability, to cause information disclosure, data tampering or a crash of the QNX Neutrino kernel.

PUBLISHED Reserved 2026-03-11 | Published 2026-07-14 | Updated 2026-07-14 | Assigner blackberry

MEDIUM: 6.4CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Problem types

CWE-367 Time-of-check time-of-use (TOCTOU) race condition

Product status

Default status

unaffected

7.1

affected

cpe:2.3:a:blackberry:qnx_software_development_platform:7.1:*:*:*:*:*:*:* (cpe)

affected

7.0

affected

cpe:2.3:a:blackberry:qnx_software_development_platform:7.0:*:*:*:*:*:*:* (cpe)

affected

Default status

unaffected

2.2.8 and earlier

affected

cpe:2.3:o:blackberry:qnx_os_for_safety:2.2:8:*:*:*:*:*:* (cpe)

affected

2.1.5 and earlier

affected

cpe:2.3:o:blackberry:qnx_os_for_safety:2.1:5:*:*:*:*:*:* (cpe)

affected

2.0.3 and earlier

affected

cpe:2.3:o:blackberry:qnx_os_for_safety:2.0:3:*:*:*:*:*:* (cpe)

affected

Default status

unaffected

2.0.2 and earlier

affected

cpe:2.3:o:blackberry:qnx_os_for_medical:2.0:2:*:*:*:*:*:* (cpe)

affected

References

support.blackberry.com/pkb/s/article/141213

cve.org (CVE-2026-4018)

nvd.nist.gov (CVE-2026-4018)

Download JSON