EUVD-2026-101953
GHSA-5jww-vc3f-xfwh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local access to NonStop host
-
DeliverySupply malformed input to EMS Distributor
-
ExploitOverflow stack buffer (CWE-121)
-
ExecutionCorrupt process memory/state
-
ImpactCause undesirable behavior or crash
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires LOCAL access to the HPE NonStop system running the EMS (Event Management Service) Distributor process, as the CVSS vector specifies AV:L - this cannot be triggered remotely over a network. The high attack complexity (AC:H) indicates additional conditions beyond attacker control must hold (e.g., specific timing, memory layout, or crafted event/message input to the Distributor) for the overflow to trigger reliably. PR:N indicates no application-level authentication to the EMS Distributor interface is needed once local access is obtained, and no user interaction (UI:N) is required. Key limiting factors for defenders: the local-only vector means an attacker must already be present on the NonStop host; impact is bounded to low integrity and low availability with no confidentiality exposure; and the NonStop platform's restricted operational footprint further limits exposure. Exact affected versions are not enumerated in the provided data - consult HPE advisory hpesbns05148en_us. |
| Impact | This is a low-priority vulnerability despite being a stack-based buffer overflow (CWE-121). The provided CVSS 3.1 vector (AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L) yields a base score of only 4.0 (Medium/Low), and every signal reinforces limited real-world risk: the attack vector is LOCAL (not network), attack complexity is HIGH (requiring specific conditions or a race/timing to be met), and the impact is limited to LOW integrity and LOW availability with NO confidentiality impact. No EPSS score was provided, this CVE is NOT in CISA KEV, and no public proof-of-concept was supplied - so there is no public exploit identified at time of analysis. The combination of local-only access, high complexity, and non-critical impact means this does not represent widespread or urgent exploitation risk. One tension to note: the CVSS lists PR:N (unauthenticated) yet AV:L (local), which implies an attacker must already have local/interactive access to the NonStop host but needs no further application-level authentication - this nuance should be verified against the HPE advisory. The constrained impact (no RCE/root claimed, only I:L/A:L) suggests undesirable behavior or a crash rather than a reliable code-execution primitive. |
| Exploit ScenarioDerived | An attacker who already has local access to an HPE NonStop system supplies crafted input to the EMS Distributor component, overflowing a stack buffer to corrupt adjacent memory. Because attack complexity is high and impact is limited to low integrity/availability, the realistic outcome is abnormal process behavior or a crash rather than full code execution. No public proof-of-concept was provided, so practical exploitation would require original research against the NonStop platform. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 15, 2026
Stack-based buffer overflow in HPE NonStop EMS Distributor (CWE-121) allows an attacker who already holds a local presence on the NonStop host to corrupt the memory of the Event Management Service Distributor process, producing low integrity and low availability impact with no confidentiality exposure. The assessed vector (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L, base 4.0) means the flaw cannot be reached remotely, requires conditions beyond the attacker's control to trigger reliably, needs no application-level authentication once local access exists, and involves no user interaction - making this a low-priority issue rather than a critical one. No public exploit code has been identified at time of analysis, there is no CISA KEV listing, and no EPSS score was supplied; the impact is bounded to the local host and to degradation of the EMS Distributor rather than a full system compromise.
RemediationAI
Patch availability is not confirmed in the provided data and no fixed version number was supplied, so the primary action is to open HPE Security Bulletin hpesbns05148en_us (https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbns05148en_us&docLocale=en_US) and apply whatever EMS Distributor update or NonStop RVU/Hotfix it prescribes, using the bulletin's version mapping to confirm which releases are corrected. Until that patch is deployed, and because the vector is strictly local (AV:L), the most effective compensating control is tightening local access to the NonStop host: restrict the set of users permitted to log on or run EMS-related commands via Safeguard user profiles and command/object-level ACLs, and audit those logons and command invocations, with the trade-off that overly broad tightening can break legitimate operator and automation workflows. Where EMS event sources can be constrained, limit which processes and users may submit or forward event messages to the Distributor - the trade-off is reduced observability for events from untrusted or legacy producers. Monitoring EMS and system logs for Distributor process abends or abnormal terminations gives early warning that the overflow is being attempted, but does not prevent it; simply blocking network ports is not a meaningful mitigation here since the attack surface is local rather than network-facing. Restricting interactive access and applying the vendor fix together are the practical path to closure.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
HPE NonStop's Event Management Service (EMS) is the event-logging and notification subsystem on the NonStop fault-tolerant platform, and the EMS Distributor process is responsible for routing and distributing event messages to consumers. CWE-121 identifies the root cause as a stack-based buffer overflow: input supplied to the Distributor - plausibly crafted event content or message data processed locally - is written into a fixed-size stack buffer without adequate bounds checking, so the write can overrun the buffer, corrupt adjacent stack memory, and produce undefined behavior such as process crash or unintended state change. The CPE cpe:2.3:a:hewlett_packard_enterprise:hpe_nonstop_ems_distributor:*:*:*:*:*:*:*:* indicates the affected component is HPE NonStop EMS Distributor with no version constraint published, so all versions should be treated as potentially in scope until HPE's advisory narrows the range. Because the vector is AV:L with AC:H, exploitation requires a foothold on the NonStop host and a precise set of conditions (timing, memory layout, or crafted event/message input) rather than a straightforward remote trigger, and the low integrity/availability ratings (I:L/A:L) with C:N reflect a bounded, non-disclosing impact class rather than remote code execution being demonstrated.
Know when Hpe Nonstop Ems Distributor gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
AV:L because EMS Distributor is a local platform process; AC:H reflects overflow conditions not fully attacker-controlled; PR:N as no app auth is cited; C:N with only I:L/A:L impact.
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
DescriptionCVE.org
HPE NonStop EMS Distributor is vulnerable to buffer overflow condition that may result in undesirable behavior.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Exploit-DB