A stack buffer overflow in the HPE NonStop Kernel Level Thread Model Lib can allow an attacker to execute arbitrary code. The vulnerability is a classic stack-based buffer overflow, classified as CWE-121.

The vulnerability affects all versions of the HPE NonStop Kernel Level Thread Model Lib from Hewlett Packard Enterprise for which no patch is currently available. The advisory does not specify particular versions, so all unpatched releases are considered vulnerable.

The CVSS score of 6.6 indicates moderate severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation. The vulnerability is not listed among CISA’s KEV catalog. Based on the description, it is inferred that an attacker would need to supply crafted input to a vulnerable function in the library to trigger a stack overflow, resulting in arbitrary code execution. If exploited, the attacker could compromise confidentiality, integrity, and availability of affected NonStop systems.