CVE-2026-50079

LowCVSS 3.3/10Last modified Nov 10, 2026

Description

Time-of-check Time-of-use (TOCTOU) Race Condition in the virtio network virtual device could allow an attacker in the guest to manipulate the virtual network device causing a crash of the QVM.

Metrics

CVSS 3.1 3.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-367

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
BlackBerry LtdQNX Hypervisorcpe:2.3:a:blackberry:qnx_hypervisor:8.0:*:*:*:*:*:*:*; cpe:2.3:a:blackberry:qnx_hypervisor:2.2:*:*:*:*:*:*:*; cpe:2.3:a:blackberry:qnx_hypervisor:2.0:*:*:*:*:*:*:*
BlackBerry LtdQNX Hypervisor for Safetycpe:2.3:a:blackberry:qnx_hypervisor_for_safety:8.0:*:*:*:*:*:*:*; cpe:2.3:a:blackberry:qnx_hypervisor_for_safety:2.2:*:*:*:*:*:*:*; cpe:2.3:a:blackberry:qnx_hypervisor_for_safety:2.0:*:*:*:*:*:*:*

References

Timeline

Published
Nov 10, 2026
Last modified
Nov 10, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-500803.3Stack-based Buffer Overflow in the ACPI event handler of the QVM could allow an attacker in a guest to crash the QVM by sending a crafted ACCVE-2026-500825.3The Aqara Cloud Developer Portal (developer.aqara.com) issued a developer token to any email address supplied by the attacker. This is an inCVE-2026-500839.8The Aqara IAM/SSO Gateway (gw-builder.aqara.com) used a hardcoded OAuth client credential, which is an instance of "CWE-798: Use of Hard-codCVE-2026-500846.5The Aqara Cloud Production API (open-cn.aqara.com/v3.0/open/api) would authorize any valid developer token for access to any account. This iCVE-2026-500859.8The Aqara Board service (op-test.aqara.com) accepts arbitrary MQTT command payloads, and forwards them to the platfom's HiveMQ broker withouCVE-2026-500869.8The Aqara IAM/SSO gateway (gw-builder.aqara.com) exposes bidirectional AES round-trups against the platform's signing key without authenticaCVE-2026-500876.1The Aqara IAM/SSO gateway (gw-builder.aqara.com) exhibits a cross-origin request sharing vulnerability, which is an instance of "CWE-942: PeCVE-2026-500884.7The Aqara Developer Portal (developer.aqara.com) and shared test environments (developer-test.aqara.com, aiot-test.aqara.com) exhibit cross-CVE-2026-500896.1The Aqara IAM/SSO Gateway (gw-builder.aqara.com) provides an open redirect, which is an instance of "CWE-601: URL Redirection to Untrusted SCVE-2026-500906.1The Aqara Cloud OAuth Authorization Endpoint (open-cn.aqara.com/oauth/authorize) is vulnerable to a redirect bypass due to lax controls on dCVE-2026-500917.4Aqara Home Android (com.lumiunited.aqarahome) 6.0.0 (and white-label clients embedding the same liblumidevsdk.so) uses hard-coded cryptograpCVE-2026-500939.0A vulnerability has been identified in Siveillance Control Pro V3.0 (All versions < V3.0.12.2173), Siveillance Control Pro V4.0 (All version
CVE-2026-50079: Low severity, CVSS 3.3 | Vulnix