HPE NonStop ODBC/MX EUVD-2026-102091

Exploitation requires local access to the HPE NonStop system with at least low-level privileges (PR:L) AND user interaction (UI:R) - it is NOT remotely or unauthenticated-exploitable. The specific trigger is crafted input processed by HPE NonStop ODBC/MX Services that overflows a stack buffer (CWE-121). Limiting factors: the attacker must already have a valid local foothold with privileges, a user action is needed to deliver the malicious input, and the demonstrated impact per HPE is an application crash (availability), not confirmed arbitrary code execution. The affected component is specifically the ODBC/MX Services layer, so systems not using ODBC/MX connectivity are not exposed.

This is a moderate, not top-tier, priority. The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:H, base 7.3) describes a LOCAL attack requiring existing low-level privileges AND user interaction, which substantially constrains real-world exploitability despite the 7.3 score - this is not a remotely reachable flaw. No EPSS score, KEV listing, or public POC is present in the supplied intelligence, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the risk signals are therefore driven almost entirely by the CVSS vector and CWE-121 classification rather than observed threat activity. The impact is primarily denial of service: the description states only memory corruption 'resulting in application crash,' with high availability impact but no vendor claim of code execution - note the tension between the Scope:Changed / C:L / I:L metrics in the input and a description that mentions only a crash, suggesting the confidentiality/integrity sub-scores may be conservative speculation about memory corruption rather than demonstrated outcomes; verify with HPE. Because HPE NonStop is a niche fault-tolerant platform, both the attack surface (local, authenticated) and the deployment footprint keep practical risk well below what the raw score implies.

A local user with low-level privileges on an HPE NonStop system interacts with ODBC/MX Services (e.g., supplies a crafted input through a client operation requiring user action) that overflows a stack buffer, corrupting memory and crashing the service. No public exploit code is available, and the realistic outcome per the vendor description is a denial-of-service crash rather than confirmed code execution. Exploitation is bounded by the need for pre-existing local access and user interaction.