QNX Hypervisor: Out-of-bounds read in virtual machine MSI-X table
Summary
A out-of-bounds read in the MSI-X table of the QNX Virtual Machine (QVM) affects QNX Hypervisor and QNX Hypervisor for Safety. An attacker with low privileges inside a guest VM can read memory outside the intended bounds, which may disclose information or crash the QVM. The attack is local and requires a foothold in a guest VM first, so it is not an internet-facing risk.
Affected
- QNX Hypervisor 8.0, 2.2 and 2.0\n- QNX Hypervisor for Safety 8.0, 2.2 and 2.0\n- Embedded or OEM products that bundle these versions (exact list unknown)
Fixed in
Unknown. No fixed version has been confirmed in the accessible sources. Check BlackBerry KB article 141343 and the BlackBerry/QNX customer portal.
Workaround
Unknown. No vendor-published workaround was found.
Exploitation
- Not known to be exploited in the wild; not listed in the KEV catalogue.\n- No public proof of concept found for this CVE.
Our recommendation
- Check whether your systems, appliances or embedded devices use QNX Hypervisor, and ask the OEM which build is shipped.\n- Track BlackBerry KB article 141343 and apply vendor patches as soon as a fixed version is published.\n- Restrict guest VM access to trusted users and monitor QVM behaviour until a fix is available.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- BlackBerry KB article 141343 (vendor advisory) support.blackberry.com
- CVE record CVE-2026-50078 (CNA) www.cve.org
- OpenCVE CVE-2026-50078 app.opencve.io
- Strix CVE-2026-50078 (NVD status) www.strix.ai
- OffSeq CVE-2026-50078 (machine-generated analysis) radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 21:12.
Original description (NVD)
Out-Of-Bounds Read in the MSI-X table in the QVM could allow an attacker in the guest to cause an information disclosure or a crash of the QVM.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.