A memory corruption flaw exists in HPE NonStop TSQLFIL and can lead to address space corruption when a specific API is invoked. The vulnerability is classified as CWE-475, indicating improper validation of memory boundaries or offsets. The result can potentially allow an attacker to overwrite critical data structures or trigger a system crash, impacting confidentiality, integrity, or availability depending on the system’s workload.

The affected product is Hewlett Packard Enterprise HPE NonStop TSQLFIL. No specific affected versions are disclosed in the available catalog data, so all deployed instances of this software are considered at risk until an official update is applied.

The CVSS score of 5.3 indicates a moderate risk level. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation yet. Because the description only references a specific API call, it is inferred that the attack vector is likely local or requires privileged access to the system; however, if the API is externally exposed, remote exploitation could be possible. The absence of an explicit exploitation path means that attackers would need to discover or guess the vulnerable function and inject crafted inputs.