IBM MQ for HPE NonStop EUVD-2026-83034

Requires (1) an IBM MQ for HPE NonStop queue manager at version 8.1.0 through 8.1.0.40, and (2) valid low-privilege authenticated access (PR:L) to a channel or queue capable of submitting messages. The specific trigger is a malformed multi-segment (segmented/reassembled) message that induces a heap buffer underflow during processing. Limiting factors: the attacker must first authenticate (no anonymous/unauthenticated path per PR:L), the flaw exists only on the specialized HPE NonStop MQ build rather than general IBM MQ distributions, and reliable arbitrary code execution is not confirmed - the dependable outcome is denial of service.

This is a legitimately high-severity vulnerability but its real-world urgency is materially constrained by platform scope. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H = 9.9) describes a network-reachable, low-complexity flaw requiring only low-privilege authentication, with a scope change (S:C) that pushes the score into critical territory. However, several signals temper this: EPSS is not provided, there is no CISA KEV listing, and no public POC has been identified, so there is no evidence of active or imminent widespread exploitation. The description hedges the impact ('or potentially execute arbitrary code'), meaning the confirmed outcome is denial of service via the heap buffer underflow, while the C:H/I:H/RCE dimension is a theoretical worst case that likely drives the vendor's full-triad and S:C rating. The S:C scope change is debatable - a heap corruption within the queue manager process does not clearly cross a security authority boundary, and without S:C the score falls to ~8.8. Net: treat this as a genuine patch priority for the specific affected estate, but not a mass-exploitation emergency - the niche HPE NonStop platform and PR:L authentication requirement make targeted rather than widespread exploitation the realistic threat model.

An attacker who already holds valid low-privilege credentials for a message channel or queue on an IBM MQ for HPE NonStop 8.1.0-8.1.0.40 queue manager crafts a malformed multi-segment message that triggers a heap buffer underflow during reassembly. In the confirmed case this crashes or destabilizes the queue manager (DoS); in the vendor-hedged worst case the memory corruption could be leveraged toward arbitrary code execution in the MQ process context. No public exploit code is known at time of analysis.