BlackBerry QNX Neutrino kernel: Heap-based buffer overflow in procnto
Summary
A heap-based buffer overflow in the DCMD_PROC_EVENT handler of the procnto component affects the QNX Neutrino kernel in QNX Software Development Platform, QNX OS for Safety and QNX OS for Medical. An attacker with local access to a device can exploit it to disclose information, tamper with data or crash the kernel. No user interaction or privileges are required, but local access is necessary.
Affected
- QNX Software Development Platform 7.0 and 7.1
- QNX OS for Safety 2.0, 2.1 and 2.2 (builds listed in the CNA record: 4, 6 and 9)
- QNX OS for Medical 2.0 (build 3)
- SDP 8.0: Unknown (to be checked against the BlackBerry advisory)
Fixed in
Unknown.
Workaround
Unknown.
Exploitation
Unknown. No evidence of exploitation or public proof of concept was found, but the NVD analysis is pending.
Our recommendation
- Check whether your devices or firmware use QNX SDP 7.0/7.1, QNX OS for Safety or QNX OS for Medical.
- Ask the vendor or OEM for the fixed build and install it as soon as available.
- Restrict local access to affected devices until a fix is installed.
- Check the BlackBerry advisory 141342 for fixed versions and vendor guidance, and monitor for updates.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- BlackBerry advisory article 141342 support.blackberry.com
- strix.ai CVE-2026-40275 www.strix.ai
- QNX documentation: DCMD_PROC_EVENT (8.0) www.qnx.com
- QNX SDP 8.0 discontinuation notice support.qnx.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 01:14.
Original description (NVD)
Heap-based Buffer Overflow in the DCMD_PROC_EVENT handler of the procnto could allow an attacker with local access to cause an information disclosure, data tampering or a crash of the QNX Neutrino kernel.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.