QNX SDP io-char library: Heap-based buffer overflow in devctl handler
Summary
A heap-based buffer overflow in the io-char library of QNX Software Development Platform allows a local attacker to tamper with data, execute arbitrary code, or crash the Character I/O device driver. The flaw is in the DCMD_CHR_WAITINFO devctl() handler. Exploitation requires local access, but no privileges or user interaction.
Affected
- BlackBerry QNX Software Development Platform 8.0
- BlackBerry QNX Software Development Platform 7.1
- QNX Software Development Platform 7.0 (listed by third-party sources only, unconfirmed)
- Default status is unaffected; exact build or patch-level ranges unknown.
Fixed in
Unknown. Check BlackBerry KB article 141341 for fixed versions.
Workaround
Unknown. No vendor or third-party workaround was found.
Exploitation
- Not listed in CISA KEV at the time of research.
- No public proof of concept or exploitation reports were found.
- CVSS 3.1 base score 7.4 (HIGH), CWE-122.
Our recommendation
- Identify all systems running QNX SDP 7.0, 7.1 or 8.0, including developer workstations and build servers.
- Open BlackBerry KB article 141341, record the fixed versions and apply the vendor patch.
- Restrict local access to affected systems and review shared or multi-tenant use.
- Recheck NVD and CISA KEV once NVD analysis is complete.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE.org CVE Record CVE-2026-54436 www.cve.org
- BlackBerry KB article 141341 support.blackberry.com
- Strix CVE-2026-54436 www.strix.ai
- Threatint CVE-2026-54436 cve.threatint.com
- Strix CVE-2026-54437 (related entry) www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 06:18.
Original description (NVD)
Heap-based Buffer Overflow in the io-char library's DCMD_CHR_WAITINFO devctl() handler could allow an attacker with local access to cause data tampering, arbitrary code execution, or a crash in the Character I/O device driver.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.