EUVD-2026-100946
GHSA-qfx5-62rf-63wv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain authenticated access to Hpjmeter host
-
DeliveryDeliver crafted profiling data file
-
ExploitVictim opens file in Hpjmeter
-
ExecutionTrigger stack/heap buffer overflow
-
ImpactCrash analysis tool (availability loss)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to supply a crafted input to HPE NonStop Hpjmeter (a Java-based performance/profiling analysis client for NonStop systems) and have an authenticated, privileged user interact with it: the CVSS vector specifies PR:H (high privileges), UI:R (victim must open/process the malicious data), and AC:H (high complexity, i.e., non-trivial conditions to reliably trigger the stack/heap overflow). Limiting factors: it is not remote-unauthenticated, needs user interaction, and yields only availability impact (A:L, no C/I), so realistic worst case is a crash of the tool. Note the description does not name a specific enabled feature or network listener, and the AV:N designation is unconfirmed against what appears to be file/data-parsing behavior - confirm the exact triggering input and delivery path in HPE advisory hpesbns05148en_us. |
| Impact | This is a low-priority, high-noise-but-low-real-risk issue, and the signals are consistent in that direction. The CVSS 3.1 base score is only 2.0 with vector AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:L: exploitation requires high attack complexity, high privileges (authenticated), and user interaction, and the only impact is low availability (C:N/I:N/A:L) - i.e., at worst a crash of the Hpjmeter analysis tool, with no confidentiality or integrity loss. No EPSS score, KEV listing, or POC was provided, so there is no evidence of exploitation probability or active abuse. One internal inconsistency should be verified: the vector states AV:N (network), yet HPjmeter is a client-side Java performance-analysis tool for HPE NonStop that processes profiling/measurement data files, which usually implies local/file-borne exploitation (AV:L) rather than a listening network service - verify the true attack surface with HPE advisory hpesbns05148en_us. The combination of CWE-122 (heap buffer overflow) with only A:L impact also suggests HPE assessed the outcome as a crash rather than code execution, though memory-corruption bugs can sometimes be escalated. Net: not a patch-now emergency; schedule in normal maintenance. |
| Exploit ScenarioDerived | An attacker crafts a malicious JVM profiling/measurement data file and convinces an authenticated operator to open or import it into HPE NonStop Hpjmeter, triggering a stack and heap buffer overflow (CWE-122). Given the high attack complexity and the A:L-only impact, the realistic outcome is a crash/denial of the analysis tool rather than reliable code execution. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Heap- and stack-based buffer overflow in HPE NonStop Hpjmeter, the Java-based performance/profiling analysis client for HPE NonStop systems, can crash the tool when it parses crafted input. Impact is confined to availability (CVSS 3.1 base score 2.0 on the vendor's published vector, assessed as A:L with no confidentiality or integrity effect), and exploitation is gated by high attack complexity and the requirement that a privileged, authenticated user open or process the malicious data - no public exploit has been identified at time of analysis. The published vector nominally claims AV:N, but the behavior described (data/file parsing by a client tool) suggests a local delivery path; this discrepancy is unconfirmed and should be validated against HPE advisory hpesbns05148en_us.
RemediationAI
No vendor-released patch or fixed version is identified in the available data, so the immediate action is to confirm the current version scope and any patched release in HPE advisory hpesbns05148en_us (https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbns05148en_us&docLocale=en_US) and apply the vendor update as soon as it is published. In the interim, because exploitation requires a privileged, authenticated user to open or process malicious data with high attack complexity and yields only a tool crash, the practical compensating controls are: restrict Hpjmeter execution to a small set of trusted, least-privileged analyst accounts and remove it from general-purpose or shared workstations (trade-off: reduced analyst convenience and slower ad-hoc profiling); enforce a strict rule that only profiling/metric files from trusted NonStop hosts are loaded into Hpjmeter, quarantining externally sourced or emailed datasets (trade-off: manual vetting overhead and possible workflow delays); run the client in a sandbox, container, or isolated jump host so a crash or memory-corruption event cannot affect other tooling or data on the host (trade-off: additional infrastructure and possible limitations on host/network access the client needs to reach NonStop systems); and, if the unresolved AV:N designation turns out to be accurate, block network exposure of any Hpjmeter listener or service to untrusted networks at the firewall and confirm with the vendor whether a network reachable service component exists (trade-off: this mitigation is speculative until the delivery vector is confirmed and may have no effect if the tool is purely file-driven). Monitor for HPE updates that clarify the actual attack vector, since the published AV:N vector and the assessed local/file-based vector have not been reconciled.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-122 (heap-based buffer overflow) with the advisory also noting a stack buffer overflow, meaning out-of-bounds writes to both dynamically allocated heap buffers and fixed-size stack buffers in HPE NonStop Hpjmeter. Hpjmeter is a Java-based client used to collect and analyze performance/profiling data from NonStop systems; the overflow class indicates missing or insufficient bounds validation on attacker-influenced length or size fields while parsing profiling/metric data, a classic pattern when native or JNI-backed parsing code handles variable-length records. The CPE entry (cpe:2.3:a:hewlett_packard_enterprise:hpe_nonstop_hpjmeter:*:*:*:*:*:*:*:*) uses a wildcard version, so no specific vulnerable release range is enumerated in the available data. Note a scoring conflict: the vendor-published vector is AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:L (2.0), while the independent assessment recharacterizes it as AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L, on the reasoning that this is file/data-parsing behavior rather than an exposed network service. Either way the only consequence modeled is a low-severity availability loss (tool crash), and the exact triggering input and delivery path are not named in the description.
Know when Hpe Nonstop Hpjmeter gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:L
HPjmeter is a client tool parsing profiling data files, so AV:L and UI:R; an operator runs it without admin rights (PR:L); reliable overflow is hard (AC:H); impact is a crash only (A:L).
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
DescriptionCVE.org
A security vulnerability in HPE NonStop Hpjmeter can cause stack and heap buffer overflow.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Exploit-DB