HiRDB Server EUVD-2026-110666

The available sources identify only a stack-based buffer overflow (CWE-121) in HiRDB Server; they do not name the specific feature, protocol, SAPI, listener, or configuration setting that must be reachable, nor is the input vector described - the trigger is not described in the available sources. The supplied CVSS (AV:N/AC:L/PR:N/UI:N) implies remote, unauthenticated, no-interaction exploitation against an affected HiRDB instance, but this is not confirmed by the description and should be validated against the Hitachi advisory. Limiting factors in practice: HiRDB is a database server typically deployed behind network segmentation and authentication, so exposure depends on whether the vulnerable interface is network-reachable by the attacker; affected builds are HiRDB Server Version 10 (10-00 before 10-12-01), Version 9 (09-00 through 09-66-22), Version 9 with Additional Function (09-00 through 09-66/V), Version 9(32) (09-02 through 09-66-22), and Version 9(32) with Additional Function (09-00 through 09-66-/V) - other versions are not in scope.

Signals are mixed. The CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) rates this critical: network-reachable, low-complexity, no privileges or user interaction, with full confidentiality, integrity and availability impact - a worst-case profile for a database server. The vuln.today decision label is 'act_now' and a vendor patch is available, which argues for prompt remediation. However, the exploitation-likelihood signals are modest: EPSS is only 0.52% (44th percentile), there is no CISA KEV listing, and no public exploit code or PoC reference is present in the provided data, so there is no evidence of active or imminent exploitation. The flaw is CWE-121 (stack-based buffer overflow), but the description gives no trigger detail - the mechanism, the affected protocol/interface, and whether the overflow is reachable pre-authentication are not described in the available sources. This matters because the PR:N in the supplied CVSS implies unauthenticated reach, yet HiRDB is a database server that commonly sits behind authentication and network segmentation; the gap between a theoretical AV:N/PR:N rating and HiRDB's typical deployment should be verified against the Hitachi advisory (hitachi-sec-2026-147). Net: treat as a high-priority patch per the 'act_now' label and the critical CVSS, but note that current exploitation probability is low and the unauthenticated-remote assumption is not independently confirmed by the description.

A remote attacker with network access to an exposed HiRDB server sends crafted input to the vulnerable interface, overflowing a stack buffer (CWE-121) and corrupting the stack to achieve code execution or a crash. Per the supplied CVSS this would require no authentication or user interaction and low attack complexity, yielding full compromise of the database host. No public exploit or PoC is identified in the provided data, and the exact trigger is not described in the available sources.