EUVD-2026-102003
GHSA-fxm9-jr33-495j
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privilege DB account
-
ExploitSend crafted SQL to SQL/MX Executor
-
ExecutionOverflow stack buffer in Executor
-
ImpactLeak stack memory or crash process
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires authenticated access to the HPE NonStop SQL/MX Executor with at least low-level privileges (CVSS PR:L), consistent with a user able to submit SQL to the Executor. The attack is network-reachable (AV:N) with low complexity (AC:L) and needs no user interaction (UI:N). Limiting factors: the attacker must possess valid database credentials, and the target is the specialized HPE NonStop platform rather than a commodity SQL engine, which sharply narrows the exposed population. The primary realistic outcome is a process crash (A:H) with partial memory disclosure (C:L); no privilege escalation or full code execution is asserted in the description. |
| Impact | This is a moderate-priority issue rather than an urgent one. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) indicates a network-reachable, low-complexity flaw, but the PR:L requirement means an attacker must already hold valid, if low-privileged, credentials on the SQL/MX database environment - this is not unauthenticated exploitation. The headline 7.6 is driven largely by A:H (process crash/denial of service); confidentiality and integrity impacts are only Low, consistent with the description's 'information disclosure or process crash' wording. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there is no signal of active or imminent exploitation. SSVC-style framing: exploitation status appears to be 'none' observed, automatability is likely low (requires authenticated SQL access to a specialized platform), and technical impact is partial. Net: a legitimate flaw worth patching in affected HPE NonStop estates, but the authentication prerequisite and niche deployment footprint place it well below internet-facing unauthenticated RCE in triage priority. |
| Exploit ScenarioDerived | An authenticated but low-privileged database user with network access to an HPE NonStop SQL/MX environment submits a crafted SQL statement or oversized input that overflows a stack buffer inside the SQL/MX Executor. The result is either leakage of adjacent stack memory contents (information disclosure) or a crash of the Executor process (denial of service). No public exploit code was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 15, 2026
Stack buffer overflow in the HPE NonStop SQL/MX Executor allows an authenticated remote user to trigger memory corruption, yielding partial information disclosure and a high-availability impact in the form of a process crash. The flaw is reachable over the network with low attack complexity and no user interaction, but requires valid credentials with at least low-level privileges (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H, base 7.6), meaning an attacker must already be able to submit SQL to the Executor. There is no confirmed active exploitation (CISA KEV) and no public exploit identified at time of analysis; the exposure is further limited because HPE NonStop is a specialized fault-tolerant platform rather than a commodity database, so this is a moderate-priority issue rather than an urgent one.
RemediationAI
No vendor-released patch identified at time of analysis: the only reference supplied is the HPE bulletin hpesbns05148en_us (https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbns05148en_us&docLocale=en_US), which should be consulted directly for the fixed release or hotfix (HPE NonStop fixes are typically distributed as SPRs or softdocs rather than CVE-specific version strings, so the exact fix identifier must come from that bulletin). Until a fix is confirmed and deployed, apply compensating controls that target the authenticated, network-reachable attack path: restrict network access to the SQL/MX Executor listener so only trusted management and application subnets can connect (trade-off: breaks remote client access for any host outside those ranges), and prune or rotate database credentials so that only the accounts genuinely required for SQL submission retain access, since the vulnerability requires valid low-privileged credentials (trade-off: additional account administration and possible disruption to shared service accounts). Where feasible, reduce the surface of untrusted or ad-hoc SQL execution against the Executor by routing application traffic through parameterized, vetted query paths and by temporarily disabling non-essential client tools or scheduled jobs that submit arbitrary statements (trade-off: loss of ad-hoc query capability and possible impact on reporting workloads). Monitor NonStop EMS logs and SQL/MX process abends for repeated Executor failures, treating unexplained crashes as potential exploitation attempts, and keep the platform at the most recent available SQL/MX SPR level as an interim hardening measure.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CVE-2026-79832 is a classic CWE-121 stack-based buffer overflow occurring in the Executor component of HPE NonStop SQL/MX, the SQL engine layered on HPE's NonStop (formerly Tandem) fault-tolerant platform. The Executor is the runtime stage that processes parsed and compiled SQL statements, so the vulnerable code path is reached through ordinary query execution over a network-reachable database connection rather than through a local-only interface. A missing or insufficient length check when copying attacker-influenced data onto a fixed-size stack buffer allows the write to overrun adjacent stack memory; per the vendor description the practical outcomes are information disclosure (reading adjacent memory, reflected as the low confidentiality impact) and process termination. The assessed vector keeps scope unchanged (S:U), which indicates the overflow does not itself cross a security boundary - no privilege escalation or arbitrary code execution is asserted, and the integrity impact is treated as none in the authoritative assessment even though the raw CVE vector lists a low integrity value. The affected component is captured by the CPE family cpe:2.3:a:hewlett_packard_enterprise:hpe_nonstop_sql/mx_executor with an unconstrained version wildcard, so the precise vulnerable release ranges must be confirmed from the vendor's advisory rather than from the CPE data.
Know when Hpe Nonstop Sql Mx Executor gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
Authenticated SQL access gives PR:L over the network (AV:N/AC:L); crash drives A:H and memory leak gives C:L, but the description asserts no integrity impact, so I:N.
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
DescriptionCVE.org
A stack buffer overflow vulnerability in HPE NonStop SQL/MX Executor may potentially result in information disclosure or process crash.
Executive ViewAI
HPE NonStop SQL/MX Executor is affected by a stack buffer overflow that can be triggered by an authenticated remote user, causing partial information disclosure and a process crash that may disrupt database availability. This vulnerability poses a moderate risk to organizations relying on the fault-tolerant platform for critical operations, as the requirement for valid low-level credentials and the lack of public exploit code reduce the likelihood of widespread exploitation. Leadership should prioritize monitoring for vendor patches and implementing interim access controls to safeguard high-availability environments.
Restrict network access to the SQL/MX Executor to trusted hosts, enforce strong authentication and least privilege for database users, monitor for abnormal process terminations, and ensure high-availability failover mechanisms are operational.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB