HPE NonStop CVE-2026-79831

Exploitation requires pre-existing local access to the HPE NonStop system with at least low-level privileges (PR:L) and the ability to invoke the Posix User Threads (pthread) functionality with attacker-controlled input that triggers the heap buffer overflow; no user interaction is needed (UI:N) and no non-default configuration is indicated by the description. Limiting factors: the attack vector is strictly local (AV:L), so the attacker must already be authenticated on the host - there is no remote or network-facing exposure, and exploitation is confined to the privilege context of the affected threading component rather than yielding inherent full-system compromise.

The vendor CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H) scores 6.6 (Medium) and describes a locally-exploitable flaw requiring low-level privileges and no user interaction - i.e., an already-authenticated local user on an HPE NonStop system. This is NOT a remotely-reachable, internet-facing vulnerability, which substantially lowers real-world urgency compared to its 'arbitrary code execution' framing. No EPSS score was provided, the CVE is not listed in CISA KEV, and no public proof-of-concept was identified, so there is no signal of active or imminent exploitation. The only disclosure source is an HPE security bulletin (HPESBNS05148), meaning this is vendor-reported with no independent corroboration of exploitation. A notable internal tension exists: the description claims 'arbitrary code execution' (which normally implies High confidentiality/integrity impact), yet the vendor assigned only C:L/I:L/A:H - suggesting the code execution is constrained to the context/privileges of the affected Posix User Threads component rather than full system takeover. Overall this is a credible but lower-priority local privilege/availability issue against a niche platform, not a mass-exploitation threat; patch on a normal cycle unless the NonStop host carries high-value fault-tolerant workloads (banking/telecom), in which case prioritize given the platform's typical criticality.

An attacker who already has a low-privileged local account (or has compromised a low-privileged process) on an HPE NonStop system invokes the vulnerable Posix User Threads functionality with crafted input that overflows a heap buffer, corrupting adjacent heap structures. Successful exploitation crashes the affected process or threading subsystem (A:H) and may allow execution of attacker-controlled code within the component's context. No public exploit code was identified at time of analysis, and exploitation requires pre-existing local access.