HPE NonStop TNS/X EUVD-2026-101871

Requires the attacker to already possess local, authenticated low-privilege access to an HPE NonStop (TNS/X) system and the ability to invoke or supply input to the Native Inspect native-mode debugger utility; the overflow is in that specific tool, not in a network-facing service. Limiting factors: AV:L means no remote/network exploitation path - physical or logged-in session access to the NonStop host is mandatory; PR:L means valid credentials/an existing account are required; UI:N means no additional victim interaction is needed once the attacker has access. Exploitation is further bounded to environments where Native Inspect is present and usable by the attacker's account.

This is a moderate-severity, locally-exploitable memory-corruption flaw (CWE-122 heap-based buffer overflow) rather than a mass-exploitation threat. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H, base 7.1) indicates a LOCAL attack vector requiring an already-authenticated low-privilege account on the NonStop system - it is NOT remotely reachable and cannot be triggered by an anonymous network attacker. No EPSS score, CISA KEV listing, SSVC decision, or public POC was provided in the intelligence set; by the precision rules this means no public exploit is identified at time of analysis and there is no evidence of active exploitation. The practical risk is therefore an authenticated local user (or a process they control) escalating integrity/availability impact on a high-assurance NonStop host by corrupting a heap address and potentially redirecting execution flow. The vendor-supplied vector sets C:N, which is notable: if execution-flow redirection genuinely yields arbitrary code execution, confidentiality would normally also be impacted - this is a point to VERIFY with HPE, as the 'potentially redirect execution flow' language and C:N are in mild tension. Overall: a real but contained local privilege/integrity issue on specialized infrastructure, meriting prompt patching on affected NonStop systems but not emergency internet-facing triage.

A low-privileged but authenticated user on an HPE NonStop system invokes the TNS/X Native Inspect debugger with crafted input that overflows a heap buffer, corrupting an address field. By controlling the corrupted pointer the attacker redirects execution flow to attacker-influenced code, undermining the integrity and availability of the process. Exploitation requires pre-existing local access; no public exploit code is identified at time of analysis.