EUVD-2026-101858
GHSA-6rc9-36vr-m5q8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged local account on NonStop
-
ExploitTrigger protection-domain overlap condition
-
ExecutionRead privileged or unmapped kernel data
-
ImpactDisclose sensitive data or crash kernel
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Hardware memory protection
|
| Exploitation Conditions | Requires an attacker to already possess authenticated, low-privileged local execution on the HPE NonStop system (AV:L, PR:L) - there is no network-facing entry point. Exploitation further depends on satisfying high-complexity conditions (AC:H), such as specific kernel state, timing, or memory layout needed to trigger the improper protection-domain boundary (CWE-1260); it is not reliably reproducible on demand. Limiting factors: no remote access, no exploitation of default network services, prior local foothold mandatory, and no user interaction path that an external attacker can leverage. These constraints make opportunistic mass exploitation impractical and confine realistic abuse to insiders or post-compromise privilege/data escalation on the specialized NonStop platform. |
| Impact | This is a moderate, not top-priority, issue. The CVSS 6.3 (Medium) vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H describes a locally-exploitable flaw (AV:L) that requires an already-authenticated low-privileged account (PR:L), high attack complexity (AC:H), and no user interaction. These signals point to a hard-to-exploit, insider/local-access weakness rather than a remotely wormable one. No EPSS score, no CISA KEV listing, and no public exploit code were supplied, so there is no public exploit identified at time of analysis and no evidence of active or widespread exploitation. CONFLICT TO VERIFY: the CVSS vector sets C:N (no confidentiality impact) yet lists I:H/A:H, while the description ('may allow user space access to privileged or unmapped data') and the vendor's own 'Information Disclosure' tag strongly imply a confidentiality/read-exposure problem - verify the intended impact dimensions with HPE advisory hpesbns05148en_us before finalizing severity. Overall: a genuine but lower-tier risk, gated behind local access and high complexity, on a niche platform. |
| Exploit ScenarioDerived | A local user with a low-privileged account on an HPE NonStop system crafts a specific sequence of operations that trips the protection-domain boundary flaw (CWE-1260), causing the kernel to expose privileged or unmapped memory to user space. Because attack complexity is high, the attacker must satisfy particular timing or state conditions to succeed; no remote entry point and no user interaction are involved. No public exploit code is known at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 15, 2026
Local low-privileged users on HPE NonStop systems can potentially read privileged or unmapped kernel memory through improper handling of overlapping protected memory ranges, resulting in disclosure of sensitive data. Exploitation requires an attacker to already hold authenticated local execution on the NonStop host and to satisfy high-complexity conditions such as a specific kernel state, timing, or memory layout, so the issue is not reliably reproducible on demand and has no network-facing entry point. This is a moderate, not top-priority, issue: no public exploit code has been identified at time of analysis, and the practical risk is confined to insiders or post-compromise escalation on this specialized platform.
RemediationAI
Patch status is not confirmed by an exact fix version in the available data; the referenced HPE security bulletin (https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbns05148en_us&docLocale=en_US) is the authoritative source for the corrected NonStop RVU/SPR level, and administrators should apply the vendor-designated kernel update rather than assuming any particular build is fixed. Because exploitation is strictly local and requires an existing low-privileged authenticated account, the most effective compensating controls are reducing who can obtain local execution on the host and reducing the value of what they can read: enforce least privilege and strict account provisioning for NonStop logons, remove or tightly control interactive and development access on production systems, and review access to privileged or sensitive data stored in memory by non-privileged applications. Restricting or monitoring use of local user-space debugging, diagnostic, and profiling facilities reduces the practical ability to probe for the overlapping-range condition, at the trade-off of limiting legitimate troubleshooting and support workflows. Since there is no remote vector, network segmentation and perimeter filtering provide no meaningful protection here, and detection should focus on audit logs for unusual local reads or anomalous process behaviour by non-privileged users until the vendor kernel fix is in place.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is classified as CWE-1260, the improper handling of overlap between protected memory ranges, a root-cause class in which memory-protection boundaries in a privileged subsystem are not enforced correctly when two protected ranges overlap. In the HPE NonStop Kernel this means kernel/user-space separation and memory-mapping protections can be partially bypassed, allowing a user-space process to observe privileged or unmapped data that should be inaccessible across the protection domain boundary. The affected component is captured generically by the CPE cpe:2.3:a:hewlett_packard_enterprise:hpe_nonstop_kernel:*:*:*:*:*:*:*:*, i.e. NonStop Kernel builds on the affected release train, with the vendor bulletin required to map the fault to specific RVU/SPR levels. The attack surface is entirely local (AV:L) and requires an existing low-privileged authenticated context (PR:L) with no user interaction (UI:N); high attack complexity (AC:H) reflects the need to arrange specific kernel or memory state to trigger the overlapping-range condition, which is why the vendor assigned a moderate base score of 6.3 and an independent assessment likewise rates confidentiality as the dominant impact (C:H/I:L/A:L) rather than a broadly exploitable code-execution primitive.
Know when Hpe Nonstop Kernel gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H
Local low-priv access with timing/state preconditions gives AV:L/PR:L/AC:H; description centers on reading privileged data so C:H, with limited I/A from potential corruption or crash of unmapped access.
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
DescriptionCVE.org
A security vulnerability in HPE NonStop Kernel may allow user space access to privileged or unmapped data.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB