Is CVE-2026-0515 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-0515 being exploited in the wild.

How severe is CVE-2026-0515?

Medium severity, with a CVSS score of 6.2, published 14 July 2026.

Which products and versions are affected?

Blackberry QNX OS for Medical 2.0.2 and earlier; Blackberry QNX OS for Safety 2.0.3 and earlier, 2.1.5 and earlier, 2.2.8 and earlier; Blackberry QNX Software Development Platform 7.0, 7.1.

Is there a fix for CVE-2026-0515?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-0515 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-2026-0515?

Check whether you run Blackberry QNX OS for Medical, Blackberry QNX OS for Safety or Blackberry QNX Software Development Platform at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-0515: BlackBerry QNX Neutrino kernel denial of service in SchedGet

CVE-2026-0515 · Severity: medium · CVSS 6.2 · Published 2026-07-14

A vulnerability exists in the QNX Neutrino real-time operating system, which is widely used in automotive, medical, and industrial control systems. A local attacker can exploit this flaw to crash the system kernel, leading to a complete loss of availability for the device. This could disrupt critical operations or safety-related functions depending on the specific deployment of the OS.

Technologies: Blackberry QNX OS for Medical, Blackberry QNX OS for Safety, Blackberry QNX Software Development Platform. Vendors: Blackberry.

Quick answers

Is CVE-2026-0515 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-0515 being exploited in the wild.
How severe is CVE-2026-0515?: Medium severity, with a CVSS score of 6.2, published 14 July 2026.
Which products and versions are affected?: Blackberry QNX OS for Medical 2.0.2 and earlier; Blackberry QNX OS for Safety 2.0.3 and earlier, 2.1.5 and earlier, 2.2.8 and earlier; Blackberry QNX Software Development Platform 7.0, 7.1.
Is there a fix for CVE-2026-0515?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-0515 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-2026-0515?: Check whether you run Blackberry QNX OS for Medical, Blackberry QNX OS for Safety or Blackberry QNX Software Development Platform at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is classified as improper handling of parameters (CWE-233) within the SchedGet() system call of the QNX Neutrino kernel. Due to insufficient validation of input parameters, a local attacker—even without elevated privileges—can invoke the system call in a manner that causes the kernel to crash. This results in a complete denial-of-service (DoS) for the affected system. The issue impacts multiple QNX-based products including the Software Development Platform (SDP), OS for Safety, and OS for Medical. Patches or updates are typically available through BlackBerry's support portal.

Affected products

BlackBerry QNX Software Development Platform 7.0, 7.1
BlackBerry QNX OS for Safety 2.0.3 and earlier, 2.1.5 and earlier, 2.2.8 and earlier
BlackBerry QNX OS for Medical 2.0.2 and earlier

Timeline

2026-07-14: disclosed
2026-07-14: advisory

References

https://support.blackberry.com/pkb/s/article/141213

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.