Hpe Nonstop Ocax
Monthly
A heap buffer overflow in HPE NonStop OCAX lets an authenticated local actor corrupt the component's address space and potentially redirect execution flow, producing high integrity and availability impact with no confidentiality impact (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H, base 7.1). Because the vector is AV:L with PR:L, exploitation requires pre-existing local access and at least low-privilege credentials on the NonStop system plus the ability to feed input to OCAX; it is not remotely reachable, so realistic exposure is limited to insiders or attackers who have already compromised a low-privilege account. There is no public exploit code identified at time of analysis and the flaw is not listed in CISA KEV, making this a medium-severity authenticated local issue rather than a top-tier emergency. HPE is the reporting vendor and the linked HPE Security Bulletin (hpesbns05148en_us) is the authoritative source for fixed versions.
A heap buffer overflow in HPE NonStop OCAX lets an authenticated local actor corrupt the component's address space and potentially redirect execution flow, producing high integrity and availability impact with no confidentiality impact (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H, base 7.1). Because the vector is AV:L with PR:L, exploitation requires pre-existing local access and at least low-privilege credentials on the NonStop system plus the ability to feed input to OCAX; it is not remotely reachable, so realistic exposure is limited to insiders or attackers who have already compromised a low-privilege account. There is no public exploit code identified at time of analysis and the flaw is not listed in CISA KEV, making this a medium-severity authenticated local issue rather than a top-tier emergency. HPE is the reporting vendor and the linked HPE Security Bulletin (hpesbns05148en_us) is the authoritative source for fixed versions.