QNX SDP traceparser Library Input Validation Vulnerability (CVE-2026-40272) Advisory

Vulnerability Overview Vulnerability ID: QNX-2026-003 CVE ID: CVE-2026-40272 Vulnerability Type: Improper Input Validation CVSS v3.1 Score: 7.0 CVSS Vector: AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CWE: CWE-1284 CAPEC: CAPEC-263 Affected Products Affected Products: - QNX SDP Version 8.0 - QNX SDP Version 7.1 - QNX SDP Version 7.0 Affected Component: traceparser library Non-Affected Products: n/a Intended Audience: Developers, administrators, and project managers who develop, maintain, or support affected QNX systems Remediation Software Updates: - QNX SDP 8.0 (target): - New Package: com.qnx.qnx800.target.microkernel.tools - Version: 0.1.0.0132720260528115L - QNX SDP 8.0 (host): - New Package: com.qnx.qnx800.host.linux.x86_64.msc - Version: 0.1.0.0132720260528115L - New Package: com.qnx.qnx800.host.win.x86_64.msc - Version: 0.1.0.0132720260528115L - QNX SDP 7.1 (target): - New Package: com.qnx.qnx710.target.microkernel.tools - Version: 0.0.0.032587202604041415L - QNX SDP 7.1 (host): - New Package: com.qnx.qnx710.host.linux.x86_64.msc - Version: 0.0.0.032587202604041415L - New Package: com.qnx.qnx710.host.win.x86_64.msc - Version: 0.0.0.032587202604041415L - New Package: com.qnx.qnx710.host.macos.x86_64.msc - Version: 0.0.0.032587202604041415L - QNX SDP 7.0 (target): - New Package: com.qnx.sdp.target.microkernel.tools - Version: 7.0.72721202606081513 - QNX SDP 7.0 (host): - New Package: com.qnx.sdp.host.linux.x86_64.msc - Version: 7.0.72721202606081513 - New Package: com.qnx.sdp.host.win.x86_64.msc - Version: 7.0.72721202606081513 Additional Information Mitigations: - Complete mitigation: Kernel tracing is not enabled on QNX targets. - Partial mitigation: The attacker must use a generic compiler or platform-level anti-vulnerability mitigation techniques. Workarounds/Recommendations: - All workarounds should be considered temporary measures. QNX recommends that customers install the latest patches as soon as possible to protect their systems. Definitions CAPEC: Common Attack Pattern Enumeration and Classification CVE: Common Vulnerabilities and Exposures CVSS: Common Vulnerability Scoring System CWE: Common Weakness Enumeration Mitigations: Measures that reduce the conditions an attacker must overcome Workarounds: Settings or configuration changes that users or administrators can apply to help secure against an attack Acknowledgments QNX thanks Mat Powell from the TrendAI Zero Day Initiative (ZDI) for reporting this issue and acknowledges ZDI's involvement in helping protect QNX customers. Change Log July 29, 2026: Initial release Legal Disclaimer All information is provided for informational purposes only and comes with no warranties or guarantees. BlackBerry Limited and its subsidiaries and affiliates are not liable for any direct, indirect, special, punitive, consequential, or incidental damages.

Goal Reached Thanks to every supporter — we hit 100%!

QNX SDP traceparser Library Input Validation Vulnerability (CVE-2026-40272) Advisory