EUVD-2026-102001
GHSA-cjm7-r6hw-2rf2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged local NonStop account
-
DeliveryInvoke Kernel Level Thread Model library with oversized input
-
ExploitOverflow stack buffer (CWE-121)
-
ExecutionHijack control flow and execute code
-
ImpactDisrupt process availability / escalate in-process
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires local access to an HPE NonStop system with a low-privilege authenticated account able to invoke the Kernel Level Thread Model library (per AV:L/PR:L); it cannot be triggered over the network or without credentials. No special non-default configuration or user interaction is indicated in the description. The primary limiting factors are the need for a pre-existing authenticated foothold on the host and the niche, operator-managed nature of the NonStop platform, which together make opportunistic mass exploitation implausible. |
| Impact | This is a moderate, non-urgent priority rather than a top-tier emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H, base 6.6) describes a locally-exploitable flaw requiring an authenticated low-privilege account, which sharply limits reach compared to a network-facing bug - an attacker must already have a foothold on the HPE NonStop system. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active exploitation or weaponization; the vulnerability was reported by the vendor (HPE) itself. The one tension to flag: the tags assert 'RCE' and the description claims 'arbitrary code execution,' yet the CVSS confidentiality and integrity impacts are only Low (C:L/I:L) with Availability High (A:H) - this suggests code execution is constrained to the privilege context of the invoking thread rather than full system compromise, so 'RCE' should be read as in-process code execution, not unauthenticated remote takeover. Treat as a patch-in-normal-cycle local privilege/stability issue, not a drop-everything network RCE. |
| Exploit ScenarioDerived | A local attacker who has already obtained a low-privileged account on an HPE NonStop system invokes the Kernel Level Thread Model library with crafted input that overflows a stack buffer (CWE-121), corrupting the stack to execute attacker-controlled code within the process context. Because the CVSS vector is AV:L/PR:L, this requires an existing authenticated foothold and cannot be launched remotely or anonymously. No public exploit code was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 15, 2026
A stack-based buffer overflow in the HPE NonStop Kernel Level Thread Model library allows a locally authenticated, low-privileged user to overwrite stack memory and, in the assessed worst case, execute arbitrary code in the context of the affected library. The vulnerability is reachable only with local access and valid low-privilege credentials (CVSS:3.1/AV:L/AC:L/PR:L/UI:N), so it cannot be triggered remotely and requires an attacker to already hold a foothold on the NonStop host; no public exploit code or confirmed active exploitation has been identified at time of analysis, and the assessed severity is moderate rather than emergency-grade. Success depends on invoking the vulnerable library from an existing session, which constrains realistic exposure to insiders, compromised local accounts, or post-exploitation privilege-escalation chains on operator-managed NonStop systems.
RemediationAI
No exact fixed version is identified in the available intelligence; the primary remediation is to consult HPE security bulletin hpesbns05148en_us (https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbns05148en_us&docLocale=en_US) and apply the SPR, hotfix, or updated library revision HPE designates for each affected NonStop release, since patch status must be confirmed against that advisory rather than assumed. Because exploitation requires local access with a low-privilege authenticated account (AV:L/PR:L), the most effective compensating controls are access-side: restrict interactive and batch logon capability to NonStop hosts to accounts that genuinely require it, remove or tightly guard unnecessary low-privilege user IDs, and avoid granting shell or OSS/Guardian command access to operators who only need application-level functions - the trade-off is reduced operational flexibility and a heavier change-approval burden for routine administration. Where applications invoke the Kernel Level Thread Model library, consider constraining which processes and user IDs can call it (for example through program-level access controls and Safeguard/Guardian file and process security), accepting that misconfiguration can break legitimate multithreaded workloads. Monitoring for unexpected process crashes or abnormal termination of library-calling processes provides a detection signal for exploitation attempts, but it is a detective, not preventive, control and generates noise on busy systems.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the HPE NonStop Kernel Level Thread Model library, a user-space-side interface into NonStop's kernel-level threading facilities used on HPE NonStop (NSK) systems - a platform typically deployed for high-availability transaction processing rather than general-purpose workloads. The root cause is CWE-121, stack-based buffer overflow: input or parameters passed into the library are copied into a fixed-size stack buffer without adequate bounds checking, allowing contiguous stack memory (including saved frame pointers and return addresses or equivalent control data) to be overwritten. Because the flaw lives in a locally invocable library rather than a network service, the CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H is consistent with the described impact: low confidentiality and integrity loss combined with a high availability impact, since a successful stack corruption can crash or destabilize the calling process and, in a thread/process model library, potentially affect broader system availability. The CPE entry cpe:2.3:a:hewlett_packard_enterprise:hpe_nonstop_kernel_level_thread_model_lib:*:*:*:*:*:*:*:* uses a wildcard version, indicating the vendor advisory does not enumerate a single affected release in the supplied data.
Know when Hpe Nonstop Kernel Level Thread Model Lib gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
Library is invoked locally by an authenticated low-privilege caller (AV:L/PR:L), with no user interaction; code executes in-process yielding limited C/I but high availability impact from stack corruption.
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
DescriptionCVE.org
A vulnerability in HPE NonStop Kernel Level Thread Model Lib can cause stack buffer overflow which can allow arbitrary code execution.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB