CVE-2026-40274
Vulnerabilities in the QNX Neutrino kernel affect QNX Software Development Platform and QNX OS for Safety
Invalid Pointer Reference in the TimerSettime() system call could allow an attacker with local access to arm a crafted timer event which can cause an information disclosure in the QNX Neutrino kernel.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
What each source reports
CVE List Score used
Vulnerabilities in the QNX Neutrino kernel affect QNX Software Development Platform and QNX OS for Safety
Invalid Pointer Reference in the TimerSettime() system call could allow an attacker with local access to arm a crafted timer event which can cause an information disclosure in the QNX Neutrino kernel.
- Record
CVE-2026-40274- CVSS 3.1
- 4.0 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-822
- Updated
- 2026-11-10
EUVDEUVD-2026-122691
Invalid Pointer Reference in the TimerSettime() system call could allow an attacker with local access to arm a crafted timer event which can cause an information disclosure in the QNX Neutrino kernel.
- Record
EUVD-2026-122691- CVSS 3.1
- 4.0 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-11
GitHub AdvisoriesGHSA-5xx2-38wx-p926
Invalid Pointer Reference in the TimerSettime() system call could allow an attacker with local...
Invalid Pointer Reference in the TimerSettime() system call could allow an attacker with local access to arm a crafted timer event which can cause an information disclosure in the QNX Neutrino kernel.
- Record
GHSA-5xx2-38wx-p926- CVSS 3.1
- 4.0 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-822
- Updated
- 2026-11-10
NVD
Invalid Pointer Reference in the TimerSettime() system call could allow an attacker with local access to arm a crafted timer event which can cause an information disclosure in the QNX Neutrino kernel.
- Record
CVE-2026-40274- CVSS 3.1
- 4.0 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-822
- Updated
- 2026-11-10
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| published | EUVD | |
| published | EUVD | |
| products, severity, title | CVE List, NVD | |
| aliases, cwes, references, severity, title | GitHub Advisories | |
| first indexed | EUVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-40274 is a medium vulnerability (CVSS 4.0) in Blackberry Ltd Qnx Os For Safety, published November 10, 2026. No source lists public exploit code. No source names a fixed version.