Riskcovery

CVE-2026-0515

Insufficient parameter validation in the QNX Neutrino kernel impacts versions of the QNX Software Development Platform and QNX OS for Safety

State
Published
Severity
6.2 Medium
Published
Jul 14, 2026
Updated
Jul 14, 2026
Reserved
Dec 10, 2025

Read the record on cve.org

Description

Insufficient Parameter Validation in the SchedGet() system call could allow an attacker with local access to cause a crash of the QNX Neutrino kernel.

Scores

CVSSScoreVectorSource
3.16.2 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hblackberry

Weaknesses

  • CWE-233 Improper handling of parameters

Affected Products

ProductVersions
QNX Software Development PlatformBlackBerry Ltd
  • 7.1Affected
  • cpe:2.3:a:blackberry:qnx_software_development_platform:7.1:*:*:*:*:*:*:*Affected
  • 7.0Affected
  • cpe:2.3:a:blackberry:qnx_software_development_platform:7.0:*:*:*:*:*:*:*Affected
QNX OS for SafetyBlackBerry Ltd
  • 2.2.8 and earlierAffected
  • cpe:2.3:o:blackberry:qnx_os_for_safety:2.2:8:*:*:*:*:*:*Affected
  • 2.1.5 and earlierAffected
  • cpe:2.3:o:blackberry:qnx_os_for_safety:2.1:5:*:*:*:*:*:*Affected
  • 2.0.3 and earlierAffected
  • cpe:2.3:o:blackberry:qnx_os_for_safety:2.0:3:*:*:*:*:*:*Affected
QNX OS for MedicalBlackBerry Ltd.
  • 2.0.2 and earlierAffected
  • cpe:2.3:o:blackberry:qnx_os_for_medical:2.0:2:*:*:*:*:*:*Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.