CVE-2002-2040: The (1) phrafx and (2) phgrafx-startup programs in QNX realtime operating system (RTOS) 4.25 and 6.1.0 do n...

Security readout for executives and security teams

This is a local privilege-escalation issue in QNX RTOS 4.25 and 6.1.0. Certain graphics-related programs may run a system command without safely dropping privileges, so a local user could cause unintended commands to run with elevated rights. It matters most where legacy QNX hosts remain in operational or embedded environments. Exposure is likely limited to systems running QNX RTOS 4.25 or 6.1.0 with the named programs present and accessible to local users. Internet-facing exposure is not indicated by the sources. Highest concern is shared-user, maintenance, lab, or embedded operational systems where local shell access exists. Address during legacy-system risk reduction, with faster action where untrusted or many users have local access. This is not evidenced as remotely exploitable or actively exploited, but it could increase the impact of any existing local compromise on old QNX deployments. Mitigation focus: Check vendor advisories for supported fixes or replacement guidance.; Restrict local shell access on affected QNX systems.; Remove or limit access to phrafx and phgrafx-startup where operationally safe..

Prepared

Jun 29, 2026, 19:05 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.