{"schemaVersion":3,"id":"CVE-2021-22156","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"An integer overflow vulnerability in the calloc() function of the C runtime library of affected versions of BlackBerry® QNX Software Development Platform (SDP) version(s) 6.5.0SP1 and earlier, QNX OS for Medical 1.1 and earlier, and QNX OS for Safety 1.0.1 and earlier that could allow an attacker to potentially perform a denial of service or execute arbitrary code.","dates":{"published":"2021-08-17T18:35:38.000Z","modified":"2025-08-22T15:20:31.911Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":9.8,"severity":"critical","version":"3.1","versionLabel":"v3.1","source":"NVD","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":9,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":9.8,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":6.8,"severity":"medium","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.01793,"percentile":0.78104,"severity":"low","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-20T00:00:00.000Z","baselineScore":0.01793},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.01793,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.01793,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.01793,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.01793,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.01793,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.01793,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.01793,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.01793,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.01793,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.01793,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.01793,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.01793,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.01793,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.01793,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.01793,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.01793,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.01793,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.01793,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.01793,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.01793,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.01793,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.01793,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.01793,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.01793,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.01793,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.01793,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.01793,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.01793,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.01793,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.01793,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.01793,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.01793,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.01793,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.01793,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.01793,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.01793,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.01793,"percentile":0.78104}],"last30":[{"date":"2026-09-20T00:00:00.000Z","score":0.01793,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.01793,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.01793,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.01793,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.01793,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.01793,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.01793,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.01793,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.01793,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.01793,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.01793,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.01793,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.01793,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.01793,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.01793,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.01793,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.01793,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.01793,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.01793,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.01793,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.01793,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.01793,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.01793,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.01793,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.01793,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.01793,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.01793,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.01793,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.01793,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.01793,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.01793,"percentile":0.78104}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-190","name":"Integer Overflow or Wraparound","description":"The product performs a calculation that can\n         produce an integer overflow or wraparound when the logic\n         assumes that the resulting value will always be larger than\n         the original value. This occurs when an integer value is\n         incremented to a value that is too large to store in the\n         associated representation. When this occurs, the value may\n         become a very small or negative number.","type":"weakness","status":"Stable","abstraction":"Base","likelihoodOfExploit":"Medium","url":"https://cwe.mitre.org/data/definitions/190.html"}],"affected":[{"vendor":"blackberry","product":"qnx_os_for_medical","name":"qnx os for medical","label":"qnx_os_for_medical","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≤ 1.1.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 1.1.1","eol":null,"hubHref":"/vendor/blackberry/qnx_os_for_medical"},{"vendor":"blackberry","product":"qnx_os_for_safety","name":"qnx os for safety","label":"qnx_os_for_safety","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≤ 1.0.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 1.0.2","eol":null,"hubHref":"/vendor/blackberry/qnx_os_for_safety"},{"vendor":"blackberry","product":"qnx_software_development_platform","name":"qnx software development platform","label":"qnx_software_development_platform","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 6.5.0","noFixRecorded":false,"fixedIn":null},{"text":"6.5.0","noFixRecorded":false,"fixedIn":null},{"text":"6.5.0:sp1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 6.5.0 | 6.5.0 | 6.5.0:sp1","eol":null,"hubHref":"/vendor/blackberry/qnx_software_development_platform"},{"vendor":"blackberry","product":"qnx software development platform (sdp), qnx os for medical and qnx os for safety","name":"QNX Software Development Platform (SDP), QNX OS for Medical and QNX OS for Safety","label":"qnx software development platform (sdp), qnx os for medical and qnx os for safety","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"QNX SDP 6.5.0 SP1 and earlier","noFixRecorded":false,"fixedIn":null},{"text":"QNX OS for Medical 1.1 and earlier","noFixRecorded":false,"fixedIn":null},{"text":"QNX OS for Safety 1.0.1 and earlier","noFixRecorded":false,"fixedIn":null}],"versionsText":"QNX SDP 6.5.0 SP1 and earlier | QNX OS for Medical 1.1 and earlier | QNX OS for Safety 1.0.1 and earlier","eol":null,"hubHref":"/vendor/blackberry/qnx_software_development_platform_sdp_qnx_os_for_medical_and_qnx_os_for_safety"}],"affectedCount":4,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://support.blackberry.com/kb/articleDetail?articleNumber=000082334","label":"support.blackberry.com/kb/articleDetail?articleNumber=000082334","hostname":"support.blackberry.com","tags":["X Refsource MISC","Patch","Vendor Advisory"]},{"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-qnx-TOxjVPdL","label":"tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-qnx-TOxjVPdL","hostname":"tools.cisco.com","tags":["Vendor Advisory","X Refsource CISCO","Third Party Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2021-08-17T18:35:38.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2025-08-22T15:20:31.911Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":70,"level":"high","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T02:17:39.602Z","stale":false,"partial":false}}