The libtraceparser decode() function fails to properly validate input from kernel trace event log (.kev) files, allowing an attacker who can supply a corrupted file to execute arbitrary code in any process that loads the library or to cause a crash. The impact is equivalent to remote code execution or denial of service within affected QNX hosts or targets.

BlackBerry Ltd’s QNX Software Development Platform is affected. No specific version information was provided, so all installations that include libtraceparser should be considered vulnerable.

The vulnerability has a CVSS score of 7, indicating high severity. The EPSS score is below 1%, suggesting a low current probability of exploitation, and it is not listed in the CISA KEV catalog. An attacker can exploit the flaw by delivering a crafted .kev file to a process that processes trace logs; the failure to sanitize input allows code execution or a crash. The likely attack vector is file-based, requiring the attacker to provide a malicious log file.