HPE NonStop TMF EUVD-2026-100959

Exploitation requires local, authenticated access to the HPE NonStop host and the ability to execute or feed crafted input to the TMF Auditread2 audit-trail utility; it cannot be triggered remotely or by an unauthenticated user. The CVSS vector's AC:H indicates a specific, hard-to-meet condition (e.g., precise input sizing or race/state to trigger the stack overflow), meaning reliable exploitation is not trivial. Limiting factors: local access only (AV:L), valid low-privilege credentials needed (PR:L), and high attack complexity - confining realistic risk to insiders or post-compromise actors on specialized NonStop deployments.

This is a moderate, locally-exploitable issue rather than an urgent remote threat. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N) confirms exploitation requires local access to the NonStop host with at least low-level authenticated privileges, plus the attacker must win a high-complexity condition (AC:H) - all of which sharply limit real-world exploitability. No EPSS score, CISA KEV listing, POC, or SSVC decision data was provided, so there is no evidence of active exploitation or automatability; this reads as a vendor-reported (HPE) hardening fix, not a weaponized bug. Two internal inconsistencies must be flagged: (1) the Description states only 'Denial of Service,' yet the vendor CVSS vector encodes I:H (high integrity impact) with only A:L (low availability impact) - the opposite of what a pure DoS would normally score - so the true impact is ambiguous and should be verified against the HPE advisory; and (2) Scope:Changed (S:C) is asserted but the description gives no indication of a sandbox/privilege boundary being crossed, inflating the 6.4 base score. Given the niche platform, local+privileged+high-complexity preconditions, and absence of any exploitation signal, this is a low-real-world-risk, high-assurance-environment patch item rather than an emergency.

An authenticated low-privileged user on an HPE NonStop system invokes the TMF Auditread2 utility with crafted input that triggers a stack-based buffer overflow (CWE-121), corrupting memory and crashing the audit-read operation to cause denial of service. Exploitation requires local access and favorable timing/conditions (AC:H), and no public exploit code is known. The practical attacker is an insider or someone who has already obtained a foothold with valid credentials.