HPE NonStop SQL/MX EUVD-2026-102024

Exploitation requires (1) local access to the HPE NonStop system with at least low-privilege authentication (CVSS PR:L, AV:L) and (2) a reachable, running SQL/MX UDR (User-Defined Routine) SERVER process that accepts and parses the crafted message. There is no user interaction requirement (UI:N). Limiting factors: this is NOT remotely exploitable without first obtaining authenticated local access, the target is a specialized NonStop database component, and deployments not using SQL/MX UDR functionality are not exposed. The primary realistic outcome is a denial of service against the database service; memory corruption may yield 'undefined behavior' but no confidentiality impact is indicated (C:N).

This is a moderate, locally-exploitable availability flaw rather than a top-tier remote threat. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H, base 7.3) is internally consistent with the description: a local, authenticated actor with low privileges can send a crafted message to the SQL/MX UDR (User-Defined Routine) SERVER to force process termination, service disruption, or memory corruption. The high availability impact (A:H) and scope change (S:C) drive the 'High' score, while confidentiality is untouched (C:N) and integrity impact is limited (I:L). Critically, the attack vector is LOCAL, not network - an attacker must already have authenticated access to the NonStop environment, which sharply limits the realistic attacker population compared to the raw 7.3 would suggest. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active exploitation or weaponization. One tension to verify: the input Tags label this 'Buffer Overflow' while the assigned CWE is CWE-20 (Improper Input Validation) and the description describes 'memory corruption...undefined behavior' - the memory-corruption language is consistent with either, but the precise defect class should be confirmed against the HPE advisory. Net: a legitimate patch-prioritization item for NonStop operators, but not an internet-facing emergency.

A low-privileged but authenticated user on an HPE NonStop system (or a compromised adjacent service account) sends a specially crafted message to the SQL/MX UDR SERVER process. The malformed input is not properly validated (CWE-20), causing the server process to terminate or its memory to be corrupted, disrupting the SQL/MX database service for other users. No public exploit code was identified at time of analysis, and the local attack vector means the actor needs prior footing on the host.