CVE-2026-73799

Executive Summary

CVE-2026-73799 is a stack-based buffer overflow (CWE-121) in the HPE NonStop SNMP Trap Multiplexer component, allowing a remote, unauthenticated attacker to trigger memory corruption. The vulnerability carries a CVSS 3.1 base score of 7.5 (High), driven entirely by a High availability impact while confidentiality and integrity impacts are assessed as None. No public proof-of-concept, exploit code, Nuclei template, or vendor patch currently exists, and the product is not listed in CISA KEV.

Technical Analysis

The vulnerability class is CWE-121, stack-based buffer overflow, occurring in the HPE NonStop SNMP Trap Multiplexer. A stack-based buffer overflow arises when a program writes more data to a fixed-length buffer allocated on the call stack than that buffer can hold. The excess data overwrites adjacent stack memory, which can corrupt local variables, saved frame pointers, and return addresses. Depending on the exact memory layout, compiler protections in effect (stack canaries, ASLR, non-executable stack), and the extent of the overflow, the practical outcome ranges from an immediate process crash and denial of service to, under favorable conditions, attacker-influenced control flow.

SNMP trap handling is inherently an untrusted-input surface. Trap multiplexers receive asynchronous trap PDUs from network devices over UDP port 162 (and potentially over TCP or other transport bindings depending on deployment). Because traps are unsolicited and typically accepted from any reachable source, there is no authentication prerequisite at the network layer for an attacker to deliver a crafted PDU to the parsing logic. This aligns directly with the CVSS vector, which specifies Attack Vector: Network, Attack Complexity: Low, Privileges Required: None, and User Interaction: None. An attacker therefore needs only network reachability to the trap multiplexer listener and no credentials.

The specific malformed field, parsing routine, and buffer that overflows are not described in the available NVD description or CNA title. The description states only that the vulnerability "may cause memory corruption." Per the accuracy constraints of this report, no function names, packet field offsets, PDU variable bindings, or code paths are asserted here, because none are present in the source intelligence. What can be stated definitively is the class (stack buffer overflow), the affected component (HPE NonStop SNMP Trap Multiplexer), the input channel (network-reachable SNMP trap processing), and the authenticated-privilege posture required of an attacker (none).

Regarding exploitability: stack overflows are frequently exploitable when the vulnerable process lacks modern mitigations or when the overwrite is large and controlled. However, the assessed impact in the CVSS vector is limited to Availability (C:N/I:N/A:H), with no confidentiality or integrity impact claimed by the scoring authority. That scoring suggests the most reliable, demonstrable outcome of triggering the flaw is a crash or hang of the multiplexer process or its host stack — a denial-of-service condition — rather than confirmed remote code execution. This is a critical distinction for defenders: the score does not assert code execution, and no exploit evidence exists to contradict that assessment.

The attack surface is narrow but potentially high-value. SNMP trap multiplexers frequently sit at the boundary between network management infrastructure and monitored systems, aggregating telemetry from many devices. A compromised or crashed multiplexer can blind an operations team to infrastructure events and, in some deployments, may run with elevated privileges or sit on a management segment with reachability into other systems.

Exploitation Scenarios

No public PoC is available for CVE-2026-73799. There is no exploit code, no Nuclei template, and no in-the-wild exploitation evidence in any tracked source. The attack chain below is therefore inferred strictly at the vulnerability-class level from CWE-121 and the NVD description; it does not rely on any fabricated function names, endpoints, or parameter identifiers.

1. Reconnaissance and target identification. An attacker scans for hosts exposing SNMP trap receiver services, canonically UDP port 162, and identifies HPE NonStop environments running the SNMP Trap Multiplexer. Shodan or similar internet-scanning services can be used to locate exposed listeners, and internal reconnaissance would identify management segments where the multiplexer is deployed. Because the service is a trap listener, it advertises its presence through the open port rather than requiring the attacker to guess an application endpoint.

2. Triggering the flaw class. The attacker crafts an SNMP trap PDU containing a field whose length or structure exceeds what the receiving parser expects for its fixed-size stack buffer. Delivery is direct over the network to the trap listener; no authentication, session establishment, or user interaction is required, consistent with PR:N and UI:N in the CVSS vector. The specific malformed element is undocumented in available intelligence and is not speculated here.

3. Payload and execution. At the vulnerability-class level, a stack buffer overflow permits overwrite of adjacent stack memory. In the best case for an attacker, overwritten return addresses or function pointers could redirect execution, but this depends on memory protections and is not established by the available data. The CVSS vector, which reports no confidentiality or integrity impact, is consistent with the more defensible scenario: the oversized write corrupts stack state and terminates or destabilizes the process.

4. Post-exploitation impact. The primary confirmed effect is memory corruption leading to process crash or hang — a denial-of-service condition affecting the trap multiplexer and, potentially, dependent monitoring workflows. If the process runs with elevated privileges and lacks mitigations, escalation to code execution cannot be ruled out in principle, but no evidence supports that outcome for this CVE. Even the DoS-only case is operationally significant: loss of trap collection degrades situational awareness across the monitored estate.

Impact Assessment

The CVSS 3.1 base score is 7.5 (High) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. Decomposed, this indicates: network-reachable (AV:N), low complexity to exploit (AC:L), no privileges required (PR:N), no user interaction (UI:N), scope unchanged (S:U, meaning impact is confined to the vulnerable component), no confidentiality impact (C:N), no integrity impact (I:N), and high availability impact (A:H).

Business impact centers on availability of network management and monitoring functions. An unauthenticated remote attacker can, at minimum, repeatedly crash the SNMP Trap Multiplexer, causing loss of trap ingestion for the duration of each outage. In operations that rely on SNMP traps for fault detection, intrusion alerting, or SLA monitoring, this translates into blind spots and delayed incident response. The blast radius is bounded by scope-unchanged scoring: the flaw affects the vulnerable component rather than cascading across a security boundary. Nonetheless, HPE NonStop systems frequently underpin transaction processing and other availability-critical workloads; degradation of their management plane can compound operational risk. There is currently no evidence of data exposure or tampering, and no confirmed code execution path.

Detection Guidance

Sigma Rule

title: HPE NonStop SNMP Trap Multiplexer Memory Corruption Attempt
id: 8f2c1a44-7d3b-4e9a-9c21-5b6f0d2e7a10
status: experimental
description: Detects process crashes or abnormal termination of the HPE NonStop SNMP Trap Multiplexer consistent with CVE-2026-73799 stack-based buffer overflow (CWE-121).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-73799
author: Threat Intelligence
date: 2026-01-01
logsource:
  category: process_creation
  product: linux
detection:
  selection_proc:
    Image|endswith:
      - '/snmp-trap-multiplexer'
      - '/snmpTrapMux'
  selection_crash:
    EventID:
      - 11
      - 1
    Message|contains:
      - 'segmentation fault'
      - 'SIGSEGV'
      - 'SIGABRT'
      - 'core dumped'
  condition: selection_proc and selection_crash
falsepositives:
  - Legitimate process restarts or maintenance
  - Unrelated crashes from other causes
level: high
tags:
  - attack.t1190
  - cve.2026-73799

YARA Rule

rule CVE_2026_73799_SNMP_Trap_Mux_Buffer_Overflow
{
    meta:
        description = "Detects artifacts or crash dumps associated with HPE NonStop SNMP Trap Multiplexer memory corruption (CVE-2026-73799)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-73799"
        cwe = "CWE-121"
        date = "2026-01-01"
        author = "Threat Intelligence"

    strings:
        $svc1 = "SNMP Trap Multiplexer" ascii wide nocase
        $svc2 = "SnmpTrapMux" ascii wide nocase
        $cwe  = "CWE-121" ascii wide
        $hpe  = "HPE NonStop" ascii wide nocase

    condition:
        (uint16(0) == 0x5A4D or uint32(0) == 0x464C457F) and
        (any of ($svc1, $svc2)) and
        any of ($cwe, $hpe)
}

Suricata IDS Rule

alert udp any any -> any 162 (msg:"CVE-2026-73799 HPE NonStop SNMP Trap Multiplexer Oversized Trap PDU Possible Buffer Overflow"; flow:to_server; content:"|A0|"; depth:1; byte_test:1,>,200,0,relative; threshold:type limit, track by_src, count 10, seconds 60; reference:cve,2026-73799; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-73799; classtype:attempted-dos; sid:202673799; rev:1;)

alert udp any any -> any 162 (msg:"CVE-2026-73799 SNMP Trap Multiplexer Large Payload to Trap Receiver"; flow:to_server; dsize:>1400; threshold:type limit, track by_src, count 5, seconds 30; reference:cve,2026-73799; classtype:attempted-dos; sid:202673800; rev:1;)

Elastic Detection

sequence by host.name with maxspan=30s
  [process where process.name : ("snmp-trap-multiplexer", "snmpTrapMux") and event.action == "start"]
  [process where process.name : ("snmp-trap-multiplexer", "snmpTrapMux") and
     (event.outcome == "failure" or message : "*SIGSEGV*" or message : "*segmentation fault*")]

Splunk SPL Query

index=* (sourcetype=syslog OR sourcetype=linux_secure)
(ProcessName="snmp-trap-multiplexer" OR ProcessName="snmpTrapMux" OR message="*SNMP Trap Multiplexer*")
(message="*segmentation fault*" OR message="*SIGSEGV*" OR message="*SIGABRT*" OR message="*core dumped*")
| stats count min(_time) as first_seen max(_time) as last_seen by host, ProcessName, message
| where count > 0
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="hpe,nonstop,snmp,">
  <rule id="202737" level="12">
    <decoded_as>syslog</decoded_as>
    <match>SNMP Trap Multiplexer</match>
    <regex>(segmentation fault|SIGSEGV|SIGABRT|core dumped|memory corruption)</regex>
    <description>CVE-2026-73799: HPE NonStop SNMP Trap Multiplexer crash or memory corruption detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_73799,availability_impact,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, no affected-version data, and no official workaround are available.

1. Immediate mitigations. Restrict network reachability to the SNMP Trap Multiplexer listener so that only trusted network-management stations and known device subnets can send traps. Enforce allowlisting at host firewalls and network ACLs rather than relying on community string secrecy, since trap ingestion is unauthenticated against the vulnerability vector. Where feasible, terminate traps at an intermediary collector that applies SNMPv3 authentication and filtering before forwarding to the HPE NonStop multiplexer. Monitor the multiplexer process for crashes and auto-restart it to reduce outage duration. Isolate the multiplexer on a dedicated management VLAN segmented from general user and production networks.

2. Patch and upgrade steps. No patch currently exists. Track HPE security advisories and the HPE NonStop support portal for a vendor fix addressing CVE-2026-73799, and upgrade to the vendor-designated fixed release as soon as it is published. Until then, treat the component as unpatched and maintain compensating network controls. Establish a change window so the fix can be applied promptly upon release.

3. Long-term hardening. Deploy SNMPv3 with authentication and privacy where supported, eliminating reliance on unauthenticated trap acceptance. Compile or run the multiplexer with modern mitigations enabled (stack canaries, ASLR, non-executable stack) and validate that they are active. Implement least-privilege service accounts so that any memory corruption does not grant elevated capability. Enable crash-dump collection and correlation against the detection rules above to establish a baseline and catch exploitation attempts. Maintain an inventory of exposed SNMP listeners and periodically audit external attack surface via passive scanning.

References

• NVD — CVE-2026-73799: https://nvd.nist.gov/vuln/detail/CVE-2026-73799
• MITRE CWE-121 — Stack-based Buffer Overflow: https://cwe.mitre.org/data/definitions/121.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• HPE Security Bulletin / NonStop Security Advisories (vendor advisory pending — no patch published): https://support.hpe.com/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-73799 not currently listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor campaigns: none identified. There is no exploit-in-the-wild evidence, no public proof-of-concept, and the CVE is not listed in CISA KEV at the time of writing.