The crypt function in QNX uses weak encryption, which allows local users to decrypt passwords.

QNX 2.4 allows a local user to read arbitrary files by directly accessing the mount point for the FAT disk partition, e.g. /fs-dos.

Multiple buffer overflows in QNX 4.25 may allow local users to execute arbitrary code via long command line arguments to (1) sample, (2) ex, (3) du, (4) find, (5) lex, (6) mkdir, (7) rm, (8) serserv, (9) tcpserv, (10) termdef, (11) time, (12) unzip, (13) use, (14) wcc, (15) wcc386, (16) wd, (17) wdisasm, (18) which, (19) wlib, (20) wlink, (21) wpp, (22) wpp386, (23) wprof, (24) write, or (25) wstrip.

The dhcp.client program for QNX 4.25 vmware is setuid, possibly by default, which allows local users to modify the NIC configuration and conduct other attacks.

Use After Free in Automotive Software platform based on QNX

Memory corruption while processing message in guest VM.

Use After Free in Automotive Software platform based on QNX

Memory corruption while handling repeated memory unmap requests from guest VM.

Stack-based Buffer Overflow in Automotive Software platform based on QNX

Memory corruption while processing control commands in the virtual memory management interface.

Stack-based Buffer Overflow in Automotive Software platform based on QNX

Memory corruption while processing client message during device management.

Improper Validation of Array Index in Automotive Software platform based on QNX

Memory corruption when triggering a subsystem crash with an out-of-range identifier.

Buffer Over-read in Automotive Software platform based on QNX

Information disclosure while processing message from client with invalid payload.