CVE-2026-40272: Blackberry Ltd Qnx Software Development Platform

High severity, CVSS 7.0. EPSS: 0.2% chance of exploitation in the next 30 days.

Improper Input Validation in the decode() function of the traceparser library could allow an attacker with a corrupted kernel trace event log (.kev) file, to execute arbitrary code or cause a crash in processes that use libtraceparser in QNX hosts or targets.

Affected products

• Blackberry Ltd Qnx Software Development Platform: version 8.0 only; version 7.1 only; version 7.0 only

Published 2026-07-29. Last modified 2026-07-30.