CVE-2026-54436: Vulnerabilities in the QNX io-char library Impacts QNX Software Development Platform

Published Nov 10, 2026

Updated

Heap-based Buffer Overflow in the io-char library's DCMDCHRWAITINFO devctl() handler could allow an attacker with local access to cause data tampering, arbitrary code execution, or a crash in the Character I/O device driver.

Affected Software

1 affected component

QNX QNX Software Development Platform

Event History

Nov 10, 2026

CVE Published

via MITRE·06:42 PM

Data Sourced

via MITRE·06:42 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:21 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is realistically exposed to this issue?

Systems using the QNX Software Development Platform with the affected io-char library are exposed if an attacker can obtain local access. The provided information does not indicate that the issue is remotely exploitable.

What does an attacker need to exploit it?

An attacker needs local access and must successfully target the DCMD_CHR_WAITINFO devctl() handler in the io-char library. The attack complexity is rated high, and no privileges or user interaction are listed as required.

What impact could successful exploitation have?

Successful exploitation could permit data tampering, arbitrary code execution, or a crash in the Character I/O device driver. The supplied severity vector rates confidentiality, integrity, and availability impacts as high.

CVE-2026-54436: Vulnerabilities in the QNX io-char library Impacts QNX Software Development Platform

Affected Software

Event History

Frequently Asked Questions

Who is realistically exposed to this issue?

What does an attacker need to exploit it?

What impact could successful exploitation have?

Company

Resources

Contact

Frequently Asked Questions

Who is realistically exposed to this issue?

What does an attacker need to exploit it?

What impact could successful exploitation have?