HPE NonStop SQL/MX EUVD-2026-102021

Exploitation requires the attacker to already hold low-level authenticated access (PR:L) to the HPE NonStop system and to interact with the SQL/MX Run-Time Statistics component specifically; it is not reachable by a fully unauthenticated attacker. The CVSS AC:H flag indicates meaningful limiting factors - the attacker must craft malformed input that satisfies specific state or timing conditions to reliably trigger the memory corruption or null pointer dereference rather than a single deterministic request. The primary realistic outcome is a process crash/DoS, with information disclosure as a secondary, lower-impact possibility. Exposure is confined to environments actually running the SQL/MX Run-Time Statistics feature on NonStop, a specialized platform.

This is a moderate-severity (CVSS 6.4) input-validation flaw (CWE-20) in HPE NonStop SQL/MX Run-Time Statistics, reported by the vendor HPE itself. The CVSS vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H) tells a consistent story: although reachable over the network (AV:N), it requires already-held low-level privileges (PR:L) and high attack complexity (AC:H), with the dominant impact being availability (A:H, i.e. process crash/DoS) and only low confidentiality/integrity impact (C:L/I:L) from potential information disclosure/memory corruption. No EPSS score, CISA KEV listing, or POC was provided in the intelligence set, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The combination of AC:H and PR:L materially lowers real-world risk versus the raw score - an attacker must be authenticated and overcome non-trivial conditions. Net: this is a credible availability/DoS concern for the specific population that runs NonStop SQL/MX, but it is not a drop-everything priority; the absence of KEV/EPSS/POC signals argues against widespread opportunistic exploitation. The 'Buffer Overflow' tag should be treated cautiously - the description cites memory corruption and null pointer dereference but does not explicitly confirm a classic buffer overflow.

An attacker with low-privilege authenticated access to an HPE NonStop system submits crafted input to the SQL/MX Run-Time Statistics component, triggering memory corruption or a null pointer dereference. This crashes the targeted process, producing a denial of service and potentially leaking fragments of process memory. No public proof-of-concept is known, and the high attack complexity (AC:H) means the attacker must satisfy specific timing or state conditions to reliably trigger the fault.