CVE-2026-4018

MediumCVSS 6.4/10Last modified Jul 15, 2026

Description

TOCTOU Race Condition in specific trace commands of the TraceEvent() system call could allow an attacker with local access and with the PROCMGR_AID_TRACE ability, to cause information disclosure, data tampering or a crash of the QNX Neutrino kernel.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-367

Affected software

Vendor	Product	Versions
BlackBerry Ltd	QNX Software Development Platform	7.1; cpe:2.3:a:blackberry:qnx_software_development_platform:7.1:::::::; 7.0; cpe:2.3:a:blackberry:qnx_software_development_platform:7.0:::::::
BlackBerry Ltd	QNX OS for Safety	2.2.8 and earlier; cpe:2.3:o:blackberry:qnx_os_for_safety:2.2:8::::::; 2.1.5 and earlier; cpe:2.3:o:blackberry:qnx_os_for_safety:2.1:5::::::; 2.0.3 and earlier; cpe:2.3:o:blackberry:qnx_os_for_safety:2.0:3::::::
BlackBerry Ltd.	QNX OS for Medical	2.0.2 and earlier; cpe:2.3:o:blackberry:qnx_os_for_medical:2.0:2::::::

References

https://support.blackberry.com/pkb/s/article/141213

Timeline

Published: Jul 14, 2026
Last modified: Jul 15, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-401807.5Quarkus OpenAPI Generator is Quarkus' extensions for generation of Rest Clients and server stubs generation. Prior to 2.16.0 and 2.15.0-lts,CVE-2026-401816.1React Router is a router for React. In versions 7.0.0 through 7.14.0 and 6.7.0 through 6.30.3, certain URLs passed to the redirect function CVE-2026-401825.9OpenTelemetry dotnet is a dotnet telemetry framework. From 1.13.1 to before 1.15.2, When exporting telemetry to a back-end/collector over gR CVE-2026-401835.5ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below 7.1.2-19, the JXL encoder h CVE-2026-401845.3TREK is a collaborative travel planner. Prior to 2.7.2, TREK served uploaded photos without requiring authentication. This vulnerability is CVE-2026-401856.5TREK is a collaborative travel planner. Prior to 2.7.2, TREK was missing authorization checks on the Immich trip photo management routes. Th CVE-2026-401866.1ApostropheCMS is an open-source Node.js content management system. A regression introduced in commit 49d0bb7, included in versions 2.17.1 of CVE-2026-401878.6In egroupware version 26.0 and earlier, an authenticated administrator can achieve OS-level Remote Code Execution (RCE) by uploading a malic CVE-2026-401887.7goshs is a SimpleHTTPServer written in Go. From 1.0.7 to before 2.0.0-beta.4, the SFTP command rename sanitizes only the source path and not CVE-2026-401899.8goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.4, goshs enforces the documented per-folder .goshs ACL/basic-auth mechanism f CVE-2026-40195.3The Complianz – GDPR/CCPA Cookie Consent plugin for WordPress is vulnerable to unauthorized data access in all versions up to, and including CVE-2026-401909.8LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to 0.5.18, the LangSmith JavaScript/TypeScript SDK (l