HPE NonStop SQL/MX EUVD-2026-102107

Exploitation requires local access to the HPE NonStop host with at least low-level privileges (PR:L), plus the ability to introduce a corrupted/malformed file that the SQL/MX EXE (SQL executor) component will parse. The 'under certain conditions' qualifier and the AC:H rating indicate the vulnerable code path is not always reachable - specific file states or processing contexts are needed, so the condition cannot be triggered deterministically. Limiting factors that reduce real-world risk: no remote network vector (local only), a valid authenticated/privileged foothold is required first, there is no user-interaction-based delivery to a victim, and successful triggering depends on hitting a non-default/edge-case parsing condition rather than a reliable primitive.

This is a medium-severity issue (CVSS 6.5) that does not rise to an urgent, drop-everything priority. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U) establishes that exploitation requires LOCAL access, already-held LOW privileges, and HIGH attack complexity - the 'under certain conditions' language in the description aligns with the AC:H rating, meaning the attacker cannot reliably trigger the out-of-bounds read on demand. Impact is mixed: confidentiality is only LOW (C:L, a partial memory leak consistent with an OOB read) while integrity and availability are HIGH (I:H/A:H), reflecting the described process termination, CPU halt, and data corruption outcomes. No EPSS score, KEV listing, or public POC is present in the provided data, so there is no evidence of active exploitation or weaponization - this is a vendor-self-reported (HPE) defensive disclosure, not an incident-driven one. The combination of local-only vector, required privileges, and high complexity strongly suggests low real-world exploitation likelihood despite the non-trivial integrity/availability impact; the realistic concern is reliability/data-integrity on a mission-critical platform rather than remote compromise. Note a minor tension to verify with the vendor: the A:H 'CPU halt' outcome implies a severe availability event on a platform specifically marketed for fault tolerance, so operators should confirm blast radius with HPE's advisory.

An attacker (or malicious insider) who already holds low-privileged local access on an HPE NonStop system supplies or plants a specially corrupted file that is subsequently processed by the SQL/MX EXE component. Under specific conditions the malformed file triggers an out-of-bounds read, leaking adjacent memory contents or crashing the process/CPU and potentially corrupting data. No public exploit code is identified, and the high attack complexity means triggering the condition reliably is non-trivial.