EUVD-2026-102093
GHSA-grc6-c3v3-rgpj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticated local access to NonStop host
-
DeliverySupply crafted oversized input to XABroker
-
ExploitTrigger stack-based buffer overflow (CWE-121)
-
ExecutionCorrupt process memory
-
ImpactCrash XABroker (denial of service)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires local access to the HPE NonStop host with a valid low-privilege authenticated account (PR:L), plus user interaction (UI:R) to deliver or process the crafted input that overflows the XABroker stack buffer. Limiting factors that reduce realistic risk: it is not remotely reachable (AV:L), the attacker must already be authenticated, a separate user action is needed to trigger it, and the documented impact is confined to an application crash (DoS) rather than data theft or code execution. No specific non-default feature toggle is named in the advisory text; the condition is simply that an attacker can reach and feed malicious input to the XABroker process. |
| Impact | This is a moderate, availability-focused issue rather than a top-tier priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:H, 7.3) describes a locally-exploitable flaw requiring an authenticated low-privilege account AND user interaction, with the dominant impact being high availability loss - consistent with the description, which limits the outcome to 'memory corruption, resulting in application crash.' There is NO EPSS score, NO CISA KEV listing, and NO public POC in the provided data, so there is no public exploit identified at time of analysis and no evidence of active or widespread exploitation. Note a conflict to verify with the vendor: the input vector asserts Confidentiality:L/Integrity:L and a changed scope (S:C), but the description describes only a crash (pure availability impact) with no mention of information disclosure, code execution, or cross-component compromise - the C:L/I:L/S:C ratings appear unsubstantiated by the text and may overstate severity. Combined with a local attack vector, required privileges, and required user interaction, real-world risk is constrained to denial-of-service by an already-authenticated local actor. |
| Exploit ScenarioDerived | An authenticated low-privilege user on an HPE NonStop system supplies a crafted oversized input to the XABroker component; the stack-based buffer overflow (CWE-121) corrupts memory and crashes the XABroker process, disrupting XA transaction brokering. No public exploit code is known, and exploitation requires both local access and user interaction, so the realistic outcome is a denial of service rather than remote takeover. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 15, 2026
A stack-based buffer overflow in HPE NonStop XABroker can corrupt memory and terminate the broker process, handing an attacker who already holds a valid low-privilege account on the NonStop host a local denial-of-service primitive against a core system service. Exploitation is constrained: the CVSS vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:R) confirms the attack is local, requires an authenticated low-privilege account, and needs a separate user action to deliver or process the crafted input, with our independent assessment narrowing the impact to availability only (S:U/C:N/I:N/A:H) rather than the confidentiality and integrity loss implied by the vendor-published score. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS data supplied, so this rates as a moderate, availability-focused issue that matters most in environments where untrusted or semi-trusted users already have NonStop logon rights.
RemediationAI
Patch availability is not confirmed in the provided data, and the CVE record exposes only HPE Security Bulletin hpesbns05148en_us (https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbns05148en_us&docLocale=en_US) as a reference; that bulletin must be consulted to determine the exact fixed RVU or patch revision for NonStop XABroker before any upgrade, because no specific fix version is stated in the intelligence supplied. Until a fix is identified and applied, treat this as a local privilege-abuse and availability problem rather than a perimeter problem: network controls will not help, since the vector is AV:L with PR:L and UI:R. The most effective compensating control is to tightly restrict which accounts can log on locally to the NonStop host and interact with XABroker - audit existing low-privilege and operator accounts, remove or disable unused ones, and enforce least privilege so that a compromised or careless user cannot feed malformed input into the broker; the trade-off is reduced operational flexibility for legitimate operators who rely on those logons. Where the XABroker process is supervised or auto-restarted, verify that restart policy so an induced crash does not cascade into repeated abend loops or service churn - the trade-off is that aggressive restart can mask an ongoing attack, so alerting on XABroker abends (via EMS or equivalent logging) should be enabled alongside it. Consider rate-limiting or validating the input path to XABroker at the application layer if feasible, noting that any input-filtering may break legitimate broker traffic and is a stopgap, not a fix. Finally, subscribe to HPE security bulletins and re-check hpesbns05148en_us for a patched NonStop release, then schedule the upgrade during a maintenance window given the availability impact of the underlying defect.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is classified as CWE-121, Stack-based Buffer Overflow, meaning a copy operation into a fixed-size buffer allocated on the XABroker process stack is not bounded by the destination size. XABroker is a broker component within the HPE NonStop environment (the CPE cpe:2.3:a:hewlett_packard_enterprise:hpe_nonstop_xabroker:*:*:*:*:*:*:*:* identifies the vendor's NonStop XABroker product specifically, with no version constraint, so the advisory does not enumerate a fixed or unaffected release). When the overflow occurs, adjacent stack contents, including saved control data, are overwritten, producing memory corruption that manifests as an application abort rather than a controlled code-execution path. The published score of 7.3 uses CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:H, assigning a changed scope and low confidentiality/integrity impact; our authoritative assessment uses S:U/C:N/I:N/A:H, i.e. we judge the consequences to be confined to the XABroker process and its availability, with no credible path to data disclosure or modification of protected data demonstrated. The local vector (AV:L), authenticated prerequisite (PR:L), and user-interaction requirement (UI:R) are the decisive constraints on this class of stack overflow: it is not network-reachable, the attacker must already possess credentials on the host, and the crafted input must be delivered or acted upon through a legitimate processing path.
Know when Hpe Nonstop Xabroker gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:H
Description limits impact to a crash, so C:N/I:N and A:H; local authenticated access with required user interaction gives AV:L/PR:L/UI:R, and no cross-component effect justifies S:U over the input's S:C.
Primary rating from Vendor (hpe).
CVSS VectorVendor: hpe
DescriptionCVE.org
A buffer overflow vulnerability in HPE NonStop XABroker may cause memory corruption, resulting in application crash.
Executive ViewAI
HPE NonStop XABroker is vulnerable to a stack-based buffer overflow that allows an authenticated local low-privilege user to crash the broker process, causing a denial-of-service condition. This vulnerability affects the availability of a core system service and could disrupt critical NonStop operations, particularly in environments where users already have local logon rights. Leadership should care because a malicious insider or compromised account could repeatedly exploit this flaw, leading to operational downtime, though no public exploit has been identified at time of analysis.
No vendor-released patch identified at time of analysis. Interim mitigations include enforcing strict least privilege for local accounts, restricting interactive logon rights on NonStop hosts, monitoring the XABroker process for crashes, and applying network segmentation to limit lateral movement.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Exploit-DB