VulnSocial

CVE-2026-40272Disclosure

LOWCVSS 7.0 · HIGH

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

  • Prioritize remediation for affected systems immediately
  • Assume compromise if assets are exposed
  • Track advisory updates for patch or workaround availability

Recommended action window: Immediate (within 24h)

NVD description

Improper Input Validation in the decode() function of the traceparser library could allow an attacker with a corrupted kernel trace event log (.kev) file, to execute arbitrary code or cause a crash in processes that use libtraceparser in QNX hosts or targets.

Back to dashboard
3.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-1284

Priority

LOW

Exploitation

ACTIVE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

  • Active exploitation appears in 1 classified signals
  • 3 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Active exploitation reported across 1 signal
  • Technical details provided in 3 signals
  • Disclosure: 3 classified signals
  • Peaked 1d ago at 2 mentions (2026-07-29); latest day: 1
  • 3 total mentions across 2 days

Deep dive

Activity timeline3 mentions / 2d
01122Mentions · 2026-07-29: 2Mentions · 2026-08-17: 1Active Exploitation · 2026-08-17: 1Technical Details · 2026-07-29: 2Technical Details · 2026-08-17: 107-2908-17
Signal classification1 categories
Disclosure
3100.0%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-07-292
Disclosure2
2026-08-171
Disclosure1
Full discourse3 posts
  • SystemTek - Technology news website@SystemTek_UK
    Disclosure

    BlackBerry QNX KEV File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVE-2026-40272) https://www.systemtek.co.uk/2026/08/blackberry-qnx-kev-file-parsing-out-of-bounds-write-remote-code-execution-vulnerability-cve-2026-40272/ via @SystemTek_UK

    Post summary

    The snippet announces a BlackBerry QNX out‑of‑bounds write RCE vulnerability (CVE‑2026‑40272) and labels it a KEV, but provides no PoC, exploit details, or patch information.

    0001067
    1.8K followersView on X
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-40272 Improper Input Validation in the decode() function of the traceparser library could allow an attacker with a corrupted kernel trace event log (.kev) file, to execute … https://www.cve.org/CVERecord?id=CVE-2026-40272 ----- Traducción: CVE-2026-40272 Val… http://infoflow.cloud`

    Post summary

    The tweet announces CVE-2026-40272, noting improper input validation in traceparser’s decode() that could enable code execution through malicious .kev files, and links to the official CVE record.

    0000035
    96 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-40272 Improper Input Validation in the decode() function of the traceparser library could allow an attacker with a corrupted kernel trace event log (.kev) file, to execute … https://www.cve.org/CVERecord?id=CVE-2026-40272

    Post summary

    The post announces CVE-2026-40272, describing an improper input validation flaw in traceparser that could enable code execution through a crafted kernel trace event log.

    00000959
    57.9K followersView on X

Explore more

Back to dashboard