# CVE-2026-40272: BlackBerry QNX traceparser improper input validation in decode function

Source: https://junglewise.ai/threats/cve-2026-40272-blackberry-qnx-traceparser-improper-input-validation-in-decode  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-29. Updated: 2026-07-29  
License: CC BY 4.0 with a link back

CVE-2026-40272 · Severity: high · CVSS 7 · Published 2026-07-29

A vulnerability exists in the BlackBerry QNX traceparser library, which is used to analyze system performance and kernel events. An attacker could provide a specially crafted or corrupted event log file that, when opened by a user, could cause the system to crash or allow the execution of unauthorized code. This could lead to a loss of system availability or the compromise of sensitive operational data on QNX-based hosts.

Technologies: [Blackberry QNX Software Development Platform](https://junglewise.ai/threats/technologies/qnx-software-development-platform). Vendors: [Blackberry](https://junglewise.ai/threats/vendors/blackberry).

## Quick answers

**Is CVE-2026-40272 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-40272 being exploited in the wild.

**How severe is CVE-2026-40272?** High severity, with a CVSS score of 7, published 29 July 2026.

**Which products and versions are affected?** Blackberry QNX Software Development Platform 7.0, 7.1, 8.0.

**Is there a fix for CVE-2026-40272?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-40272 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-40272?** Check whether you run Blackberry QNX Software Development Platform at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An improper input validation vulnerability (CWE-1284) exists in the decode() function within libtraceparser. The flaw is triggered when the library processes a corrupted kernel trace event log (.kev) file. While the attack vector is local, it requires a high degree of complexity and user interaction, as a user must be enticed to open the malicious file. Successful exploitation can lead to arbitrary code execution or a denial-of-service (crash) in any process utilizing the affected library on QNX hosts or targets. The vulnerability affects QNX Software Development Platform versions 7.0, 7.1, and 8.0.

## Affected products

- BlackBerry QNX Software Development Platform 7.0, 7.1, 8.0

## Timeline

- 2026-07-29: advisory: Initial advisory published by BlackBerry and NVD.

## References

- [https://support.blackberry.com/pkb/s/article/141229](https://support.blackberry.com/pkb/s/article/141229)

## Related threats

- [BlackBerry QNX Neutrino Kernel TOCTOU Race Condition in TraceEvent](https://junglewise.ai/threats/cve-2026-4018-blackberry-qnx-neutrino-kernel-toctou-race-condition-in-traceevent)
- [BlackBerry QNX Neutrino kernel buffer overflow in TraceEvent system call](https://junglewise.ai/threats/cve-2026-4017-blackberry-qnx-neutrino-kernel-buffer-overflow-in-traceevent)
- [BlackBerry QNX Neutrino kernel denial of service in SchedGet](https://junglewise.ai/threats/cve-2026-0515-blackberry-qnx-neutrino-kernel-denial-of-service-in-schedget)