A security vulnerability in HPE NonStop Java JToolkit can allow attackers to inject arbitrary operating system commands and trigger a buffer overflow. The issue is a classic system call injection flaw (CWE-78) that can give an attacker the ability to execute commands with the privileges of the JToolkit process, potentially compromising confidentiality, integrity, and availability of the affected system. The vulnerability is reported with a CVSS score of 3.8, indicating a low but non‑negligible impact once exploited.

The affected product is Hewlett Packard Enterprise's HPE NonStop Java JToolkit. No specific version information is provided in the CVE entry, so all installations of this product are potentially susceptible until a vendor‑issued fix is applied.

With a CVSS score of 3.8 and an EPSS score of less than 1%, the likelihood of exploitation is currently very low, and the vulnerability is not listed in CISA's KEV catalog. The likely attack vector is inferred to be remote, as an attacker would need to supply crafted input to the JToolkit service over the network in order to trigger the command injection and buffer overflow.