EUVD-2026-101005
GHSA-rh8v-jmj7-3hhx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local low-privileged account
-
ExploitInvoke specific vulnerable TSQLFIL API
-
ImpactTrigger address space corruption, disrupt service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Undefined behavior for input
|
| Exploitation Conditions | Requires local access to the HPE NonStop host and a low-privileged account (PR:L) able to call the specific affected TSQLFIL API that mishandles input (CWE-475), causing address space corruption. Exploitation is LIMITED by high attack complexity (AC:H) - the attacker must meet specific preconditions outside their control to reliably trigger the corruption - and by the requirement for local, authenticated access rather than remote or network reach (AV:L). No user interaction by a victim is needed (UI:N). The precise API and input conditions are not enumerated in the available HPE advisory data. |
| Impact | This is a genuinely low-to-moderate priority issue despite its MEDIUM rating. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H, base 5.3) requires LOCAL access, LOW privileges, and HIGH attack complexity, which collectively make opportunistic or remote exploitation impractical. No EPSS score, KEV listing, or public exploit was provided, so exploitation likelihood is low: no public exploit identified at time of analysis, and the vulnerability is not on CISA KEV. The dominant impact is availability (A:H - address space corruption likely crashes or destabilizes the process) with limited integrity impact (I:L) and NO confidentiality impact (C:N). CONFLICTING SIGNAL: the input Tag 'Information Disclosure' contradicts the CVSS vector's C:N (no confidentiality impact) and the CWE-475 / address-space-corruption nature of the flaw - this tag appears mislabeled and should not drive triage. Net: a real but low-urgency defect primarily relevant to availability/stability of HPE NonStop TSQLFIL, gated behind local authenticated access and high complexity. |
| Exploit ScenarioDerived | A local user with low-level privileges on an HPE NonStop system invokes a specific TSQLFIL API with conditions that trigger address space corruption, destabilizing or crashing the affected process and causing a denial of service. The HIGH attack complexity (AC:H) means the attacker must satisfy specific, non-trivial preconditions beyond their control to reliably trigger the corruption. No public exploit code is known to exist. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Address space corruption in HPE NonStop TSQLFIL is reachable by a low-privileged local user on the NonStop host who invokes a specific affected API, which mishandles input and drives undefined behavior in the process memory space. The assessed vector (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H, score 5.3) shows no confidentiality loss but high availability impact, so the realistic outcome is integrity damage and/or abnormal termination of the affected TSQLFIL process rather than data theft. Exploitation is constrained by local authenticated access and by high attack complexity requiring preconditions outside the attacker's control, and no public exploit has been identified at time of analysis; there is no confirmed active exploitation (CISA KEV).
RemediationAI
No fixed version can be cited from the available data, so the first step is to open HPE security bulletin hpesbns05148en_us (https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbns05148en_us&docLocale=en_US) and match its affected/fixed version matrix against the exact NonStop RVU and TSQLFIL revision running on each host; where HPE lists a corrected RVU or TSQLFIL SPR, plan that installation through the normal NonStop release-update maintenance window, since applying it requires bringing down or restarting the affected TSQLFIL process and has an availability cost of its own. Refined patch availability for this CVE is not independently confirmed in the supplied data, so do not assume a fix exists for every RVU. Until a supported fix is applied, compensating controls should be targeted rather than generic: restrict interactive local logon and Safeguard/OS user identities that can reach the TSQLFIL API to the smallest possible set of trusted operators and administrators (this reduces the PR:L exposure but does not protect against misuse by an already-authorized insider or a compromised low-privileged account); review application and batch job code that calls TSQLFIL so that only validated, expected argument sets are passed to the API, since CWE-475 exploitation depends on supplying unusual input; and tighten monitoring for abnormal aborts, memory-fault dumps, or unexpected restarts of the TSQLFIL process, treating repeated events as evidence of attempted triggering. Because the assessed impact is availability-dominant with high A, ensure process supervision and restart policies are healthy so an induced address-space fault degrades to a recoverable process failure rather than a wider outage, accepting that automatic restarts can mask repeated exploitation attempts.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
TSQLFIL is a component of the HPE NonStop software stack identified by the CPE cpe:2.3:a:hewlett_packard_enterprise:hpe_nonstop_tsqlfil, one of the server-side modules reached through the platform's TSQL interface set. The root cause class is CWE-475 (Undefined Behavior for Input to API): the affected API accepts input it does not sufficiently validate or constrain, so a caller can hand it arguments that produce undefined behavior inside the callee, which in this instance manifests as corruption of the calling/processing address space rather than a controlled error return. Because the vector is AV:L/AC:H and the flaw is in input handling rather than in a network parser or memory-copy of externally supplied bulk data, exploitation stays inside the NonStop host boundary and requires the attacker to already hold a working local account (PR:L) and to satisfy timing/state conditions that the assessment rates as high complexity; UI:N means no victim action is required to trigger it, but the advisory does not enumerate the exact API signature, argument values, or subsystem state needed. Note that the supplied tag 'Information Disclosure' is a broad classifier and is not supported by the assessed vector, which scores confidentiality impact as None (C:N) - the credible effect is limited integrity impact and significant availability impact, consistent with an address-space fault aborting or destabilizing the affected NonStop process.
Know when Hpe Nonstop Tsqlfil gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H
API is invoked locally by a low-privileged user (AV:L/PR:L), reliable triggering needs specific conditions (AC:H); corruption chiefly disrupts availability (A:H) with no confidentiality impact (C:N).
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
DescriptionCVE.org
A security vulnerability in HPE NonStop TSQLFIL may cause address space corruption when a specific API is called.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
Exploit-DB