EIP-2026-114689

PRE-CVE

QNX 6.5.0 x86 phfont - Local Privilege Escalation

Title source: legacy
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-114689. PoCs published by cenobyte.

AI-analyzed exploit summary This is a functional local privilege escalation exploit for QNX 6.5.0 targeting a buffer overflow in the setuid-root binary /usr/photon/bin/phfont via the PHOTON_PATH environment variable. It uses a return-to-libc technique to execute system() with a crafted payload, ultimately spawning a root shell.

Description

QNX 6.5.0 x86 phfont - Local Privilege Escalation

Exploits (1)

exploitdb WORKING POC
by cenobyte · clocalqnx
https://www.exploit-db.com/exploits/32155

This is a functional local privilege escalation exploit for QNX 6.5.0 targeting a buffer overflow in the setuid-root binary /usr/photon/bin/phfont via the PHOTON_PATH environment variable. It uses a return-to-libc technique to execute system() with a crafted payload, ultimately spawning a root shell.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: QNX 6.5.0, 6.4.1 (phfont binary)
No auth needed
Prerequisites: Local access to a vulnerable QNX system · Presence of /usr/photon/bin/phfont with setuid root
devstral-2 · analyzed Feb 18, 2026 Full analysis →

Details

Status pre_cve
Tracked Since Feb 18, 2026