Blackberry Qnx Momentics vulnerabilities

2 CVEs affecting Blackberry Qnx Momentics, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-32025, published 2022-03-10.

More from Blackberry.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2008-3024, published 2008-07-07. High severity, CVSS 9.3. EPSS: 5.9% chance of exploitation in the next 30 days. Stack-based buffer overflow in phgrafx in QNX Momentics (aka RTOS) 6.3.2 and earlier allows local users to gain privileges via a long .pal filename in palette/.
• CVE-2021-32025, published 2022-03-10. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. An elevation of privilege vulnerability in the QNX Neutrino Kernel of affected versions of QNX Software Development Platform version(s) 6.4.0 to 7.0, QNX Momentics all 6.3.x versions, QNX OS for…