CVE-2026-40272 - Vulnerability Details - OpenCVE

Improper Input Validation in the decode() function of the traceparser library could allow an attacker with a corrupted kernel trace event log (.kev) file, to execute arbitrary code or cause a crash in processes that use libtraceparser in QNX hosts or targets.

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Exploitation none

Automatable no

Technical Impact total

No data.

No data.

No data.

No data.

References

Link	Providers
https://support.blackberry.com/pkb/s/article/141229

History

Wed, 29 Jul 2026 18:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Wed, 29 Jul 2026 18:15:00 +0000

Type	Values Removed	Values Added
Description		Improper Input Validation in the decode() function of the traceparser library could allow an attacker with a corrupted kernel trace event log (.kev) file, to execute arbitrary code or cause a crash in processes that use libtraceparser in QNX hosts or targets.
Title		Vulnerability in the QNX libtraceparser Impacts QNX Software Development Platform
Weaknesses		CWE-1284
References		https://support.blackberry.com/pkb/s/article/141229
Metrics		cvssV3_1 `{'score': 7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H'}`

MITRE

Status: PUBLISHED

Assigner: blackberry

Published: 2026-07-29T17:58:27.761Z

Updated: 2026-07-29T18:08:13.992Z

Reserved: 2026-04-10T17:41:10.441Z

Link: CVE-2026-40272

Vulnrichment

Updated: 2026-07-29T18:08:07.435Z

NVD

No data.

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-40272", "assignerOrgId": "dbe78b00-5e7b-4fda-8748-329789ecfc5c", "state": "PUBLISHED", "assignerShortName": "blackberry", "dateReserved": "2026-04-10T17:41:10.441Z", "datePublished": "2026-07-29T17:58:27.761Z", "dateUpdated": "2026-07-29T18:08:13.992Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "dbe78b00-5e7b-4fda-8748-329789ecfc5c", "shortName": "blackberry", "dateUpdated": "2026-07-29T17:58:27.761Z"}, "title": "Vulnerability in the QNX libtraceparser Impacts QNX Software Development Platform", "datePublic": "2026-07-29T17:21:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-1284", "description": "CWE-1284 Improper validation of specified quantity in input", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-263", "descriptions": [{"lang": "en", "value": "CAPEC-263 Force Use of Corrupted Files"}]}], "affected": [{"vendor": "BlackBerry Ltd", "product": "QNX Software Development Platform", "versions": [{"status": "affected", "version": "8.0", "versionType": "custom"}, {"status": "affected", "version": "cpe:2.3:a:blackberry:qnx_software_development_platform:8.0:*:*:*:*:*:*:*", "versionType": "cpe"}, {"status": "affected", "version": "7.1", "versionType": "custom"}, {"status": "affected", "version": "cpe:2.3:a:blackberry:qnx_software_development_platform:7.1:*:*:*:*:*:*:*", "versionType": "cpe"}, {"status": "affected", "version": "7.0", "versionType": "custom"}, {"status": "affected", "version": "cpe:2.3:a:blackberry:qnx_software_development_platform:7.0:*:*:*:*:*:*:*", "versionType": "cpe"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Improper Input Validation in the decode() function of the traceparser library could allow an attacker with a corrupted kernel trace event log (.kev) file, to execute arbitrary code or cause a crash in processes that use libtraceparser in QNX hosts or targets.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Improper Input Validation in the decode() function of the traceparser library could allow an attacker with a corrupted kernel trace event log (.kev) file, to execute arbitrary code or cause a crash in processes that use libtraceparser in QNX hosts or targets."}]}], "references": [{"url": "https://support.blackberry.com/pkb/s/article/141229", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "LOCAL", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "HIGH", "baseScore": 7, "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"}}], "source": {"advisory": "QNX-2026-003", "discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.4"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-29T18:08:02.435661Z", "id": "CVE-2026-40272", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-29T18:08:13.992Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-40272", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-07-29T18:08:02.435661Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-29T18:08:07.435Z"}}], "cna": {"title": "Vulnerability in the QNX libtraceparser Impacts QNX Software Development Platform", "source": {"advisory": "QNX-2026-003", "discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-263", "descriptions": [{"lang": "en", "value": "CAPEC-263 Force Use of Corrupted Files"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "BlackBerry Ltd", "product": "QNX Software Development Platform", "versions": [{"status": "affected", "version": "8.0", "versionType": "custom"}, {"status": "affected", "version": "cpe:2.3:a:blackberry:qnx_software_development_platform:8.0:*:*:*:*:*:*:*", "versionType": "cpe"}, {"status": "affected", "version": "7.1", "versionType": "custom"}, {"status": "affected", "version": "cpe:2.3:a:blackberry:qnx_software_development_platform:7.1:*:*:*:*:*:*:*", "versionType": "cpe"}, {"status": "affected", "version": "7.0", "versionType": "custom"}, {"status": "affected", "version": "cpe:2.3:a:blackberry:qnx_software_development_platform:7.0:*:*:*:*:*:*:*", "versionType": "cpe"}], "defaultStatus": "unaffected"}], "datePublic": "2026-07-29T17:21:00.000Z", "references": [{"url": "https://support.blackberry.com/pkb/s/article/141229", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 1.0.4"}, "descriptions": [{"lang": "en", "value": "Improper Input Validation in the decode() function of the traceparser library could allow an attacker with a corrupted kernel trace event log (.kev) file, to execute arbitrary code or cause a crash in processes that use libtraceparser in QNX hosts or targets.", "supportingMedia": [{"type": "text/html", "value": "Improper Input Validation in the decode() function of the traceparser library could allow an attacker with a corrupted kernel trace event log (.kev) file, to execute arbitrary code or cause a crash in processes that use libtraceparser in QNX hosts or targets.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1284", "description": "CWE-1284 Improper validation of specified quantity in input"}]}], "providerMetadata": {"orgId": "dbe78b00-5e7b-4fda-8748-329789ecfc5c", "shortName": "blackberry", "dateUpdated": "2026-07-29T17:58:27.761Z"}}}, "cveMetadata": {"cveId": "CVE-2026-40272", "state": "PUBLISHED", "dateUpdated": "2026-07-29T18:08:13.992Z", "dateReserved": "2026-04-10T17:41:10.441Z", "assignerOrgId": "dbe78b00-5e7b-4fda-8748-329789ecfc5c", "datePublished": "2026-07-29T17:58:27.761Z", "assignerShortName": "blackberry"}, "dataVersion": "5.2"}