CVE-2024-48856 is a critical severity (CVSS 9.8) out-of-bounds write in the PCX image codec of BlackBerry QNX Software Development Platform 8.0, 7.1 and 7.0. An unauthenticated attacker could cause denial of service or run code in the process using the codec. Check BlackBerry advisory 140334 for the fix.
What's affected
The record lists QNX SDP versions 8.0, 7.1 and 7.0 as affected. The weakness is in the PCX image codec, so the exposed systems are ones that decode PCX images from untrusted sources.
The NVD record does not list fixed versions, and the BlackBerry page could not be retrieved in full during review. Treat the vendor advisory as the authority and do not assume a patch level.
Because QNX is used in embedded and automotive style products, the affected software often reaches you through a device maker rather than directly.
How to check if you're exposed
List which of your products embed QNX SDP and which of them use the image codec libraries. Ask your suppliers for a statement against advisory 140334.
grep -ril "pcx" ./src ./build 2>/dev/null | head
If you build on QNX yourself, check the SDP version of your toolchain and target images. The question to answer is whether any process in your product decodes PCX files that came from outside, such as uploads, removable media or network transfers.
What to do now
- Inventory products built on QNX SDP 7.0, 7.1 or 8.0.
- Read the BlackBerry advisory and apply the stated patch or updated image.
- If a patch is not available for your version, disable PCX decoding where the product allows it.
- Stop processing PCX files from untrusted sources.
- Ask suppliers of QNX based devices for their patch status in writing.
Why it matters
The weakness is CWE-787 (Out-of-bounds Write). The codec writes decoded image data past the end of a buffer, which corrupts neighbouring memory. A crash is the mild outcome. With care, an attacker can steer execution into code of their choice in the context of the process that called the codec.
Image and file format parsers are a long running source of memory bugs because the input is complex and often untrusted. The 9.8 score reflects network reach with no privileges and no user interaction. The record does not flag exploitation, and the CVE is not on the KEV list. Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan that you can use to check manifests for known CVEs, and the Gold directory lists this one at https://gold.safeguard.sh/vulnerability/CVE-2024-48856.
Quick check
Which QNX versions are affected?
The record lists QNX SDP 8.0, 7.1 and 7.0.
Is there a confirmed fixed version?
Not in the record. Check BlackBerry advisory 140334 before you decide.
Sources
Last reviewed: 19 October 2026.
