CVE-2026-40274: Vulnerabilities in the QNX Neutrino kernel affect QNX Software Development Platform and QNX OS for Safety
Published Nov 10, 2026
·Updated
Invalid Pointer Reference in the TimerSettime() system call could allow an attacker with local access to arm a crafted timer event which can cause an information disclosure in the QNX Neutrino kernel.
Affected Software
3 affected components
QNX QNX Neutrino kernel
QNX QNX Software Development Platform
QNX QNX OS for Safety
Event History
Nov 10, 2026
CVE Published
via MITRE·07:03 PM
Data Sourced
via MITRE·07:03 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·07:21 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who is exposed to this issue?
Systems running the affected QNX Neutrino kernel, QNX Software Development Platform, or QNX OS for Safety are potentially exposed if an attacker can obtain local access.
2
What does an attacker need to exploit it?
The attacker needs local access and must arm a crafted timer event through the TimerSettime() system call. No privileges or user interaction are indicated by the supplied vector.
3
What is the impact of successful exploitation?
Successful exploitation can disclose information from the QNX Neutrino kernel. The provided assessment does not indicate integrity modification or service disruption.