QNX SDP PCX Image Codec Out-of-Bounds Write Vulnerability Allowing Code Execution or Denial-of-Service

An out-of-bounds write vulnerability has been identified in the PCX image codec of QNX Software Development Platform (SDP) versions 8.0, 7.1, and 7.0. This vulnerability could allow an unauthenticated attacker to cause a denial-of-service condition or execute code in the context of the process using the image codec. The vulnerability arises when the image codec is induced to parse a maliciously crafted PCX format image file.

Impact

Exploitation of this vulnerability could lead to a denial-of-service condition or allow for remote code execution in the context of the process using the image codec.

Remediation

QNX has released updates for the affected PCX image codec in QNX SDP versions 8.0, 7.1, and 7.0. These updates are available through the QNX Software Center. QNX recommends that all affected customers update their QNX-based products at their earliest convenience.