HPE NonStop NDSREST EUVD-2026-101970

Exploitation requires low-privilege authenticated access (PR:L) to an HPE NonStop system running the NDSREST component, and the ability to deliver crafted input to that component to trigger the heap overflow. Per the vendor CVSS vector the attack is local (AV:L), which limits exposure to actors who already have a foothold or valid credentials on the host; no user interaction is required (UI:N) and attack complexity is low (AC:L). Note that the product name suggests a REST interface - if NDSREST is in fact exposed over the network in a given deployment, the effective reachability may be broader than AV:L implies, so verify the deployment exposure with HPE.

This is a moderate-severity (CVSS 7.1) heap buffer overflow in HPE NonStop NDSREST. The vendor-supplied CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) describes a locally-exploitable flaw requiring low-privilege authentication, with low attack complexity and no user interaction, impacting integrity and availability but not confidentiality. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active exploitation - this appears to be a patch-priority-by-severity issue rather than an urgent in-the-wild threat. One notable tension: the product name 'NDSREST' implies a REST service, which would typically be network-reachable, yet the vendor rates the vector as local (AV:L); this discrepancy should be verified with HPE because a network vector would materially raise the real-world risk. The combination of I:H/A:H with C:N aligns with the description's 'corrupt resume-execution address / redirect execution flow,' consistent with a control-flow-hijack/crash primitive rather than data disclosure. Overall priority is tempered by the local attack vector, required privileges, and the niche deployment base of the NonStop platform.

An attacker who already holds a low-privilege account on an HPE NonStop system sends crafted input to the NDSREST component, triggering a heap buffer overflow that corrupts the saved resume-execution address. With low attack complexity and no user interaction required, this can crash the service (availability loss) or potentially redirect execution flow to attacker-influenced code paths. No public exploit code was identified at time of analysis.