How severe is CVE-2019-8998?

CVE-2019-8998 has a CVSS 3.x base score of 7.8, rated high severity. It is exploitable over local access with high attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2019-8998 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (13th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2019-8998?

CVE-2019-8998 affects Blackberry Qnx Software Development Platform. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2019-8998?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2019-8998 published?

CVE-2019-8998 was published on 2019-07-12 and last updated on 2026-06-17.

CVE-2019-8998

CVE-2019-8998 is a high-severity vulnerability in Blackberry Qnx Software Development Platform with a CVSS 3.x base score of 7.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-413.

Key facts

Severity: High (CVSS 3.x base score 7.8)
CVSS v2: 4.6
EPSS exploit prediction: 0% (13th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-413
Affected product: Blackberry Qnx Software Development Platform
Published: 2019-07-12
Last modified: 2026-06-17

Description

An information disclosure vulnerability leading to a potential local escalation of privilege in the procfs service (the /proc filesystem) of BlackBerry QNX Software Development Platform version(s) 6.5.0 SP1 and earlier could allow an attacker to potentially gain unauthorized access to a chosen process address space.

Frequently asked questions

What is CVE-2019-8998?: An information disclosure vulnerability leading to a potential local escalation of privilege in the procfs service (the /proc filesystem) of BlackBerry QNX Software Development Platform version(s) 6.5.0 SP1 and earlier could allow an attacker to potentially gain unauthorized access to a chosen process address space.
How severe is CVE-2019-8998?: CVE-2019-8998 has a CVSS 3.x base score of 7.8, rated high severity. It is exploitable over local access with high attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2019-8998 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (13th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2019-8998?: CVE-2019-8998 affects Blackberry Qnx Software Development Platform. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2019-8998?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2019-8998 published?: CVE-2019-8998 was published on 2019-07-12 and last updated on 2026-06-17.

References

http://support.blackberry.com/kb/articleDetail?articleNumber=000057178

Affected products (1)

cpe:2.3:a:blackberry:qnx_software_development_platform:*:*:*:*:*:*:*:*

More vulnerabilities in Blackberry Qnx Software Development Platform

CVE-2020-6932 — Critical (CVSS 10.0): An information disclosure and remote code execution vulnerability in the slinger web server of the BlackBerry QNX…
CVE-2025-2474 — Critical (CVSS 9.8): Out-of-bounds write in the PCX image codec in QNX SDP versions 8.0, 7.1 and 7.0 could allow an unauthenticated attacker…
CVE-2024-48856 — Critical (CVSS 9.8): Out-of-bounds write in the PCX image codec in QNX SDP versions 8.0, 7.1 and 7.0 could allow an unauthenticated attacker…
CVE-2021-32024 — Critical (CVSS 9.8): A remote code execution vulnerability in the BMP image codec of BlackBerry QNX SDP version(s) 6.4 to 7.1 could allow an…
CVE-2017-3891 — Critical (CVSS 9.6): In BlackBerry QNX Software Development Platform (SDP) 6.6.0, an elevation of privilege vulnerability in the default…
CVE-2024-35213 — Critical (CVSS 9.0): An improper input validation vulnerability in the SGI Image Codec of QNX SDP version(s) 6.6, 7.0, and 7.1 could allow…

All CVEs affecting Blackberry Qnx Software Development Platform →

Other CWE-413 vulnerabilities

CVE-2025-3450 — Critical (CVSS 10.0): An Improper Resource Locking vulnerability in the SDM component of B&R Automation Runtime versions before 6.3 and…
CVE-2023-28649 — High (CVSS 8.6): The Hub in the Snap One OvrC cloud platform is a device used to centralize and manage nested devices connected to it. A…
CVE-2022-49737 — High (CVSS 7.7): In X.Org X server 20.11 through 21.1.16, when a client application uses easystroke for mouse gestures, the main thread…
CVE-2026-32748 — High (CVSS 7.5): Squid is a caching proxy for the Web. Prior to version 7.5, due to premature release of resource during expected…
CVE-2025-0003 — High (CVSS 7.3): Inadequate lock protection within Xilinx Run time may allow a local attacker to trigger a Use-After-Free condition…
CVE-2023-33951 — Medium (CVSS 6.7): A race condition vulnerability was found in the vmwgfx driver in the Linux kernel. The flaw exists within the handling…

Browse all CWE-413 vulnerabilities →