CVE-2026-40275: Vulnerabilities in the QNX Neutrino kernel affect QNX Software Development Platform and QNX OS for Safety

Published Nov 10, 2026

Updated

Heap-based Buffer Overflow in the DCMDPROCEVENT handler of the procnto could allow an attacker with local access to cause an information disclosure, data tampering or a crash of the QNX Neutrino kernel.

Affected Software

3 affected components

QNX QNX Neutrino kernel

QNX QNX Software Development Platform

QNX QNX OS for Safety

Event History

Nov 10, 2026

CVE Published

via MITRE·06:58 PM

Data Sourced

via MITRE·06:58 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:21 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What access does an attacker need to exploit this issue?

An attacker needs local access to the affected system. The vector indicates no privileges or user interaction are required.

Which systems should be prioritized for triage?

Prioritize systems using the QNX Neutrino kernel, QNX Software Development Platform, or QNX OS for Safety, particularly where untrusted users or processes can obtain local access.

What is the potential impact of successful exploitation?

Successful exploitation could disclose information, tamper with data, or crash the QNX Neutrino kernel. The reported severity is high, with high confidentiality, integrity, and availability impact.

CVE-2026-40275: Vulnerabilities in the QNX Neutrino kernel affect QNX Software Development Platform and QNX OS for Safety

Affected Software

Event History

Frequently Asked Questions

What access does an attacker need to exploit this issue?

Which systems should be prioritized for triage?

What is the potential impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to exploit this issue?

Which systems should be prioritized for triage?

What is the potential impact of successful exploitation?