CVE-2026-40272: Vulnerability in the QNX libtraceparser Impacts QNX Software Development Platform

Severity: high (CVSS 7.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-29 · updated 2026-10-24
Weakness: CWE-1284

Description

Improper Input Validation in the decode() function of the traceparser library could allow an attacker with a corrupted kernel trace event log (.kev) file, to execute arbitrary code or cause a crash in processes that use libtraceparser in QNX hosts or targets.

Affected products

BlackBerry Ltd QNX Software Development Platform: 8.0, cpe:2.3:a:blackberry:qnx_software_development_platform:8.0:*:*:*:*:*:*:*, 7.1, cpe:2.3:a:blackberry:qnx_software_development_platform:7.1:*:*:*:*:*:*:*, 7.0, cpe:2.3:a:blackberry:qnx_software_development_platform:7.0:*:*:*:*:*:*:*

References

https://support.blackberry.com/pkb/s/article/141229

Get alerted when CVE-2026-40272 or the next vulnerability affects your stack