What’s Vulnerable › Vulnerabilities

CVE-2021-22156

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-08-17 · updated 2026-06-17
• Weakness: CWE-190

Description

An integer overflow vulnerability in the calloc() function of the C runtime library of affected versions of BlackBerry® QNX Software Development Platform (SDP) version(s) 6.5.0SP1 and earlier, QNX OS for Medical 1.1 and earlier, and QNX OS for Safety 1.0.1 and earlier that could allow an attacker to potentially perform a denial of service or execute arbitrary code.

Affected products

• BlackBerry Qnx Os For Medical: through 1.1.1
• BlackBerry Qnx Os For Safety: through 1.0.2
• BlackBerry QNX Software Development Platform (SDP): before 6.5.0; 6.5.0, 6.5.0-sp1 — fixed in 6.5.0

How to fix

Upgrade to a fixed version: BlackBerry QNX Software Development Platform (SDP) 6.5.0. Check the vendor advisory for mitigations.

References

• https://support.blackberry.com/kb/articleDetail?articleNumber=000082334
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-qnx-TOxjVPdL
• https://support.blackberry.com/kb/articleDetail?articleNumber=000082334
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-qnx-TOxjVPdL

Get alerted when CVE-2021-22156 or the next vulnerability affects your stack