HPE NonStop Python CVE-2026-79824

Exploitation requires the victim to extract an attacker-controlled TAR archive using HPE NonStop Python 3.x (the TAR-extraction code path, consistent with Python's tarfile module). The concrete prerequisite is that untrusted archive contents are extracted without path sanitization; the attacker must be able to supply or substitute the archive. Limiting factors: user/process interaction is mandatory (UI:R) - there is no server-side auto-trigger - and the write primitive is bounded by the privileges of the extracting process, so impact depends on what files that account may overwrite. The vendor's AV:A (Adjacent) rating further implies the archive must reach the system over an adjacent network path rather than arbitrary remote delivery; this vector should be confirmed with HPE as such bugs are typically local.

This is a moderate-priority issue whose real-world risk is tempered by its exploitation model rather than its 8.0 CVSS score. The vendor-supplied vector (AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) rates it High, but several signals pull against treating it as an urgent, widespread threat. First, exploitation is not autonomous: UI:R means a user or process must extract an attacker-supplied TAR archive, so this is a 'malicious-archive' class bug (CWE-30 / the classic Python tarfile extraction traversal pattern), not a remotely-triggerable service flaw. Second, the AV:A (Adjacent) attack vector is questionable for a file-extraction bug - archive-extraction traversal is almost always Local (the victim runs extraction on data they received), so the vector choice should be verified with HPE; if it is effectively local, real exposure is narrower than AV:A implies. Third, the C:H rating is suspect: the description states only that attackers can 'overwrite arbitrary files,' which is a write/integrity primitive, not a read/disclosure one, so Confidentiality:High may be overstated. No EPSS score, KEV listing, or POC was provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net: a genuine integrity/availability flaw worth patching on affected NonStop systems, but its niche platform, user-interaction requirement, and absence of exploitation signals make it a managed-patch item rather than an emergency.

An attacker crafts a TAR archive containing entries whose filenames embed '../' sequences, then delivers it to a victim running HPE NonStop Python 3.x (e.g. via a data-exchange or deployment pipeline). When the victim's code extracts the archive, the traversal sequences escape the intended directory and overwrite arbitrary files the extracting process can write, potentially corrupting configuration or executables. No public exploit was provided, but the underlying Python tarfile extraction-traversal technique is well understood and trivial to reproduce.