NonStop Debug Utilities EUVD-2026-101998

Exploitation requires LOCAL access to an HPE NonStop system and an authenticated, low-privileged context (CVSS PR:L) with the ability to invoke the Debug Utilities and feed them attacker-controlled input that triggers the heap buffer overflow (CWE-122). The specific precondition is interactive or programmatic use of the NonStop Debug Utilities component - a debugging/diagnostic tool - rather than any network-facing service. Limiting factors that reduce realistic risk: no remote vector (AV:L), a required pre-existing foothold with privileges, no user-interaction dependency (UI:N), and deployment confined to the specialized HPE NonStop platform. The description's 'may potentially redirect execution flow' indicates that reliable control-flow hijack is not guaranteed and likely depends on heap layout and the specific debug operation performed.

This is a moderate, not top-priority, vulnerability whose risk is tightly bounded by its access requirements. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H, base 7.1) confirms that exploitation requires LOCAL access and at least low-level privileges (PR:L) - this is not a remotely reachable, unauthenticated flaw. The impact profile is high integrity and high availability with no confidentiality loss (C:N), consistent with a heap overflow (CWE-122) that corrupts the resume-execution address and may redirect control flow but is not described as leaking data. No EPSS score, KEV listing, or POC indicator was provided in the input; accordingly there is no public exploit identified at time of analysis and no evidence of active exploitation. The single vendor reference (HPE advisory hpesbns05148en_us) is the authoritative source. The key limiting signals (local vector, required privileges, a niche platform) materially outweigh the 'may potentially redirect execution flow' language, which is itself hedged in the description. Treat as a routine-to-prioritized patch for the affected HPE NonStop estate rather than an emergency: there is no signal-conflict here - all indicators (local, authenticated, no known exploitation) point consistently to contained risk, with the main unknown being whether control-flow redirection is reliably achievable (the description says 'may potentially', which should be verified against the HPE advisory).

An attacker who already holds a low-privileged account on an HPE NonStop system invokes the vulnerable Debug Utilities and supplies crafted input that overflows a heap buffer, corrupting the stored resume-execution address. By controlling that address, the attacker may redirect execution flow to attacker-influenced code, potentially elevating their effective capability or crashing the debugged process. No public proof-of-concept exploit was identified at time of analysis, and the description qualifies control-flow redirection as a potential rather than demonstrated outcome.