HPE NonStop Inspect CVE-2026-79827

Exploitation requires local authenticated access (AV:L, PR:L) to an HPE NonStop system and interaction with the Inspect debugging subsystem - the component named in the description - to supply input that overflows the heap buffer controlling the resume-execution address. There is no network vector and no unauthenticated path: an attacker must already hold a valid low-privilege account on the host. Limiting factors are the need for prior authentication, local presence, and access to the Inspect subsystem, which confine realistic exploitation to insiders or post-compromise scenarios rather than remote attackers; exact triggering versions/configuration should be confirmed against HPE advisory hpesbns05148en_us.

The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H, score 7.1) describes a locally-exploitable, low-privilege-authenticated flaw with no confidentiality impact but high integrity and availability impact - consistent with a heap buffer overflow (CWE-122) in a debugging subsystem that could corrupt a saved resume-execution address and redirect control flow. No EPSS score, CISA KEV listing, SSVC decision data, or public POC is present in the input, so there is no evidence of active exploitation or automatable mass exploitation. The real-world risk is moderate and contingent: the local attack vector and PR:L requirement mean an attacker must already have authenticated access to the NonStop host before exploiting this, which substantially narrows the threat to insiders or post-compromise privilege/integrity escalation rather than internet-facing attacks. The I:H/A:H with C:N pairing fits control-flow hijack enabling code execution/crash without a direct data-disclosure primitive. This is a priority for HPE NonStop operators as a defense-in-depth/local-escalation issue, but it is not a drop-everything internet-exposed emergency; absent EPSS and KEV, treat exploitation likelihood as currently low and driven by targeted/insider access rather than widespread activity.

An authenticated user with local access to an HPE NonStop system invokes or interacts with the Inspect debugging subsystem and supplies crafted input that overflows a heap buffer, corrupting the stored resume-execution address. When execution resumes, control flow is redirected to attacker-influenced data, potentially yielding code execution or a crash. No public exploit code is identified in the provided data.