EUVD-2026-101812
GHSA-6hvh-xvxj-cjhj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege access to NonStop system
-
DeliveryCraft malformed input for QIOMON
-
ExploitInduce user action to process it
-
ExecutionTrigger out-of-bounds write
-
ImpactCorrupt buffer data, impact integrity/availability
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Exploitation requires the attacker to already possess low-privilege authenticated access to the HPE NonStop environment (CVSS PR:L) AND requires a legitimate user to perform an action that causes QIOMON to process attacker-influenced input (CVSS UI:R) - both are genuine limiting factors that prevent fully remote, unauthenticated, automated exploitation. The specific QIOMON input path, configuration, or interface that must be reached is not detailed in the available description or the single HPE advisory reference, so the exact triggering feature should be confirmed against HPE bulletin hpesbns05148en_us. Affected scope is HPE NonStop QIOMON version T8671L02^ABH and earlier. |
| Impact | This is a moderate-priority issue rather than an emergency. The CVSS 3.1 base score of 7.6 (vector AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H) reflects a network-reachable out-of-bounds write with low attack complexity, but two signals materially dampen real-world risk: PR:L means the attacker must already hold some authenticated/low-privilege access, and UI:R means a legitimate user must perform an action for the attack to succeed. There is no EPSS score in the provided data, the CVE is NOT on the CISA KEV list, and no public proof-of-concept is referenced - so all signals point to a theoretical/vendor-reported weakness, not observed exploitation. Note a data inconsistency worth verifying with HPE: the CWE is CWE-20 (Improper Input Validation) and the tag says 'Buffer Overflow,' while the description specifies an out-of-bounds write (more precisely CWE-787); this does not change severity but indicates loose classification. Overall: a legitimate high-severity bug by score, but the authentication + user-interaction requirements plus the absence of exploitation/EPSS/POC signals make it a patch-in-normal-cycle item rather than a drop-everything priority, especially given the niche platform. |
| Exploit ScenarioDerived | An attacker with low-privilege authenticated access to an HPE NonStop system sends or stages specially crafted input to the QIOMON component and induces a legitimate user to trigger its processing, causing an out-of-bounds write that corrupts buffer data. This can degrade integrity and availability of the monitored subsystem (I:H/A:H) with limited information disclosure (C:L). No public exploit code was identified at time of analysis, so weaponization effort would fall on the attacker. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 15, 2026
Out-of-bounds write in HPE NonStop QIOMON (T8671L02^ABH and earlier) allows a low-privilege authenticated actor to corrupt adjacent buffer memory when QIOMON processes attacker-influenced input, with the integrity and availability impact rated High and confidentiality impact Low. Exploitation is constrained on two fronts: the attacker must already hold authenticated low-privilege access to the NonStop environment (CVSS PR:L) and a legitimate user must perform an action that feeds malicious input into QIOMON (CVSS UI:R), so the issue is not exploitable as an end-to-end unauthenticated remote attack. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV; EPSS data was not provided, so it should be treated as a moderate-priority, non-emergency hardening item.
RemediationAI
The authoritative remediation guidance is HPE security bulletin hpesbns05148en_us (https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbns05148en_us&docLocale=en_US), which should be read in full for the exact corrected QIOMON build level; the fixed version number is not specified in the available intelligence, so no patch identifier should be assumed and administrators must confirm the required build directly from HPE before validating remediation as complete. Where an immediate update cannot be scheduled, the two prerequisites in the CVSS vector define the practical compensating controls. First, reduce the population of principals holding even low-privilege authenticated access to QIOMON-adjacent resources, since PR:L means any authenticated foothold may suffice; enforce least privilege on NonStop user IDs that can reach the component and require separate credentials for administrative and operational functions, accepting the operational overhead that stricter account separation imposes. Second, because UI:R indicates a human must trigger the vulnerable processing path, restrict which operators and procedures are permitted to submit input to QIOMON, disable or gate any non-essential input or import interfaces that feed the component, and require change control for those workflows - the trade-off is reduced flexibility for batch or ad-hoc processing. Network-level containment can be added by isolating the NonStop management and QIOMON traffic onto a segmented, access-controlled subnet and blocking it from general user networks, though this may disrupt legitimate remote administration. Finally, enable logging and monitoring on QIOMON and the host for abends, traps, process terminations, and anomalous buffer-related errors, since these are the observable indicators of a failed or partially successful out-of-bounds write, and treat them as incident triggers. None of these controls eliminate the underlying flaw, and they should be treated as interim measures only, since no public exploit code has been identified at time of analysis but the memory-corruption class remains a persistent availability and integrity risk for unpatched systems.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
QIOMON is an HPE NonStop subsystem component that processes input on behalf of the NonStop environment, and the flaw is an out-of-bounds write in which insufficient validation of supplied data allows memory beyond the intended buffer to be overwritten. The assigned CWE is CWE-20 (Improper Input Validation), which is the root-cause class flagged by the vendor: the component accepts input without adequately constraining length, structure, or content before writing it into a fixed-size buffer, so the write is a downstream consequence of the missing validation rather than a separate logic error. The CPE string cpe:2.3:a:hewlett_packard_enterprise:hpe_nonstop_qiomon:*:*:*:*:*:*:*:* uses a wildcard version field, indicating the advisory covers the QIOMON product line broadly, while the EUVD data pins the concretely affected build level at T8671L02^ABH and earlier. The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H indicates the attack can be delivered over the network with low complexity but requires prior authenticated privileges and victim interaction, and the scope value S:U means the resulting impact is confined to QIOMON's own security authority rather than escalating to the surrounding NonStop operating environment - a meaningful mitigating characteristic. The integrity and availability ratings of High reflect that a successful out-of-bounds write can corrupt in-memory state and potentially destabilize the component, while the Low confidentiality rating suggests only limited unintended data exposure. The single reference, HPE bulletin hpesbns05148en_us, is the authoritative source; the precise QIOMON input path, interface, or configuration parameter that must be reached to trigger the write is not disclosed in the available description, so the triggering feature must be confirmed against that bulletin.
Know when Hpe Nonstop Qiomon gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H
Network-reachable but gated by existing low privilege (PR:L) and required user interaction (UI:R); out-of-bounds write primarily harms integrity/availability (I:H/A:H) with limited disclosure (C:L).
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
DescriptionCVE.org
A vulnerability in HPE NonStop QIOMON allows an out-of-bounds write that can corrupt buffer data.
Executive ViewAI
A memory corruption vulnerability in HPE NonStop QIOMON (T8671L02^ABH and earlier) could allow an authenticated low-privilege user, with user interaction, to disrupt service integrity and availability on affected NonStop systems, which often underpin mission-critical transaction processing. Although exploitation requires existing access and a legitimate user action-and no public exploit identified at time of analysis-the potential for operational disruption makes this a moderate-priority hardening item that warrants leadership attention. No vendor-released patch identified at time of analysis.
No vendor-released patch identified at time of analysis; interim mitigations include restricting QIOMON access to authenticated low-privilege users only, enforcing least privilege, monitoring for anomalous input or process crashes, implementing network segmentation, and applying any HPE advisory workarounds. Enhance logging and alerting on QIOMON memory errors.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Exploit-DB