BlackBerry vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-40272 Improper Input Validation in the decode() function of the traceparser library could allow an attacker with a corrupted kernel trace event log (.kev) file, to exHigh 7 · Jul 29, 2026
• CVE-2026-18084 Improper Neutralization of Input During Web Page Generation vulnerability in BlackBerry UEM Management Console of BlackBerry UEM allows Cross-Site Scripting (XSHigh 8.6 · Jul 28, 2026
• CVE-2026-4017 Buffer Overflow in the entry handler of the TraceEvent() system call could allow an attacker with local access to cause information disclosure, data tampering oHigh 7.4 · Jul 14, 2026
• CVE-2025-2474 Out-of-bounds write in the PCX image codec in QNX SDP versions 8.0, 7.1 and 7.0 could allow an unauthenticated attacker to cause a denial-of-service condition oCritical 9.8 · Jun 10, 2025
• CVE-2024-48858 Improper input validation in the PCX image codec in QNX SDP versions 8.0, 7.1 and 7.0 could allow an unauthenticated attacker to cause a denial-of-service condiHigh 7.5 · Jan 14, 2025
• CVE-2024-48857 NULL pointer dereference in the PCX image codec in QNX SDP versions 8.0, 7.1 and 7.0 could allow an unauthenticated attacker to cause a denial-of-service conditHigh 7.5 · Jan 14, 2025
• CVE-2024-48856 Out-of-bounds write in the PCX image codec in QNX SDP versions 8.0, 7.1 and 7.0 could allow an unauthenticated attacker to cause a denial-of-service condition oCritical 9.8 · Jan 14, 2025
• CVE-2024-51721 A code injection vulnerability in the SecuSUITE Server Web Administration Portal of SecuSUITE versions 5.0.420 and earlier could allow an attacker to potentiallHigh 7.3 · Nov 12, 2024
• CVE-2024-35214 A tampering vulnerability in the CylanceOPTICS Windows Installer Package of CylanceOPTICS for Windows version 3.2 and 3.3 could allow an attacker to potentiallyHigh 7.1 · Aug 20, 2024
• CVE-2024-35213 An improper input validation vulnerability in the SGI Image Codec of QNX SDP version(s) 6.6, 7.0, and 7.1 could allow an attacker to potentially cause a denial-Critical 9 · Jun 11, 2024
• CVE-2023-32701 Improper Input Validation in the Networking Stack of QNX SDP version(s) 6.6, 7.0, and 7.1 could allow an attacker to potentially cause Information Disclosure orHigh 7.1 · Nov 14, 2023
• CVE-2023-21521 An SQL Injection vulnerability in the Management Console  (Operator Audit Trail) of BlackBerry AtHoc version 7.15 could allow an attacker to potentially read sHigh 7.2 · Sep 12, 2023
• CVE-2021-32025 An elevation of privilege vulnerability in the QNX Neutrino Kernel of affected versions of QNX Software Development Platform version(s) 6.4.0 to 7.0, QNX MomentHigh 8.1 · Mar 10, 2022
• CVE-2021-32024 A remote code execution vulnerability in the BMP image codec of BlackBerry QNX SDP version(s) 6.4 to 7.1 could allow an attacker to potentially execute code in Critical 9.8 · Dec 13, 2021
• CVE-2021-32023 An elevation of privilege vulnerability in the message broker of BlackBerry Protect for Windows version(s) versions 1574 and earlier could allow an attacker to High 7.8 · Nov 10, 2021
• CVE-2021-32021 A denial of service vulnerability in the message broker of BlackBerry Protect for Windows version(s) versions 1574 and earlier could allow an attacker to potentHigh 7.8 · Nov 10, 2021
• CVE-2021-22156 An integer overflow vulnerability in the calloc() function of the C runtime library of affected versions of BlackBerry® QNX Software Development Platform (SDP) Critical 9 · Aug 17, 2021
• CVE-2021-22153 A Remote Code Execution vulnerability in the Management Console component of BlackBerry UEM version(s) 12.13.1 QF2 and earlier and 12.12.1a QF6 and earlier coulHigh 7.3 · May 13, 2021
• CVE-2021-22155 An Authentication Bypass vulnerability in the SAML Authentication component of BlackBerry Workspaces Server (deployed with Appliance-X) version(s) 10.1, 9.1 andHigh 8.8 · May 12, 2021
• CVE-2020-6932 An information disclosure and remote code execution vulnerability in the slinger web server of the BlackBerry QNX Software Development Platform versions 6.4.0 tCritical 10 · Aug 12, 2020
• CVE-2019-8998 An information disclosure vulnerability leading to a potential local escalation of privilege in the procfs service (the /proc filesystem) of BlackBerry QNX SoftHigh 7.8 · Jul 12, 2019
• CVE-2019-8999 An XML External Entity vulnerability in the UEM Core of BlackBerry UEM version(s) earlier than 12.10.1a could allow an attacker to potentially gain read access High 7.5 · Apr 18, 2019
• CVE-2018-8890 An information disclosure vulnerability in the Management Console of BlackBerry UEM 12.8.0 and 12.8.1 could allow an attacker to take over a UEM user's session High 7.5 · Oct 12, 2018
• CVE-2017-3891 In BlackBerry QNX Software Development Platform (SDP) 6.6.0, an elevation of privilege vulnerability in the default configuration of the QNX SDP with QNet enablCritical 9.6 · Nov 14, 2017
• CVE-2017-9368 An information disclosure vulnerability in the BlackBerry Workspaces Server could result in an attacker gaining access to source code for server-side applicatioHigh 7.5 · Oct 16, 2017