CVE-2026-4017

Deferred Deferred - Pending Action

Buffer Overflow in QNX Neutrino Kernel via TraceEvent

Publication date: 2026-07-14

Last updated on: 2026-07-15

Assigner: BlackBerry

Description

Buffer Overflow in the entry handler of the TraceEvent() system call could allow an attacker with local access to cause information disclosure, data tampering or a crash of the QNX Neutrino kernel.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-14

Last Modified

2026-07-15

Generated

2026-08-04

AI Q&A

2026-07-15

EPSS Evaluated

2026-08-02

NVD

CVE-2026-4017

EUVD

EUVD-2026-44320

Affected Vendors & Products

Vendor	Product	Version / Range
blackberry	qnx_neutrino_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-121	A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

Attack-Flow Graph

Executive Summary

This is a buffer overflow vulnerability in the TraceEvent() system call's entry handler within the QNX Neutrino kernel. It allows an attacker with local access to potentially disclose information, tamper with data, or crash the kernel.

Detection Guidance

This vulnerability is specific to the QNX Neutrino kernel and requires local access to exploit. Detection may involve monitoring for unusual system behavior, crashes, or kernel panics. Check kernel logs for trace event handler errors or unexpected buffer overflows. No specific commands are provided in the context.

Impact Analysis

An attacker could exploit this to cause system instability, access sensitive data, or modify critical system files. This could lead to unauthorized access, data breaches, or denial of service on affected QNX Neutrino systems.

Compliance Impact

This vulnerability could lead to data breaches or unauthorized access, which may violate GDPR (data protection) and HIPAA (health data privacy) requirements. Compliance could be impacted if systems are not patched, risking legal penalties or loss of certification.

Mitigation Strategies

Apply patches or updates from BlackBerry for the QNX Neutrino kernel to address the buffer overflow in the TraceEvent() system call. Restrict local access to trusted users only to reduce attack surface.

Hi! I’m here to help you understand CVE-2026-4017. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70