QNX SDP io-char library: Improper input validation allows local data tampering
Summary
The io-char library in BlackBerry's QNX Software Development Platform contains improper input validation in the DCMD_CHR_TCINJECTC devctl() handler. A local attacker with low privileges can tamper with data in the memory input buffer of the character I/O device driver. The vulnerability requires local access and no user interaction, and it impacts integrity only.
Affected
- BlackBerry QNX Software Development Platform 8.0 and 7.1 (per CNA record)
- QNX Software Development Platform 7.0 (listed by a third-party aggregator only, unverified)
- Default status in the CNA record: unaffected
Fixed in
Unknown. The vendor advisory could not be retrieved.
Workaround
Unknown. No vendor workaround was found.
- Interim measure: restrict local logins and shell access on affected QNX hosts, and limit which processes can reach character device nodes.
Exploitation
No evidence of exploitation in the wild, public proof of concept or CISA KEV listing was found at the time of research. NVD analysis was pending.
Our recommendation
- Check whether QNX SDP 7.0, 7.1 or 8.0 is used in your devices or systems, for example in machinery, measurement or control equipment.
- Review BlackBerry advisory KB 141341 and apply the fixed version when available.
- Limit local access to trusted users and monitor access to affected systems.
- Check the related CVE-2026-54436 in the same library together with this CVE.
- Standard office IT (Windows, Linux, Microsoft 365) is not affected.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE Record CVE-2026-54437 www.cve.org
- BlackBerry advisory KB 141341 support.blackberry.com
- QNX devctl character I/O documentation www.qnx.com
- QNX ioctl reference (8.0) www.qnx.com
- Strix AI entry CVE-2026-54437 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 14:06.
Original description (NVD)
Improper Input Validation in the io-char library's DCMD_CHR_TCINJECTC devctl() handler could allow an attacker with local access to cause data tampering in the memory input buffer of the Character I/O device driver.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.