A vulnerability in HPE NonStop EXPAND permits an out‑of‑bounds memory read, which can trigger a buffer overflow. This defect falls under improper array bounds checking and can corrupt adjacent memory, potentially allowing an attacker to alter program flow or execute arbitrary code. The primary consequence is a compromise of data integrity and the execution environment, with possible breach of confidentiality if controlled data is overwritten.

The affected product is Hewlett Packard Enterprise’s HPE NonStop EXPAND. Version information is not supplied in the advisory; therefore any deployment of HPE NonStop EXPAND that has not yet applied the vendor’s latest security update is potentially vulnerable.

The CVSS score of 7.1 indicates a high severity plausible for attempts with moderate complexity. Exploit probability is not listed in EPSS, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is not specified in the advisory; the buffer overflow is likely exploitable through exposed network services or by local users with sufficient filesystem access. Based on the nature of the flaw, it is inferred that a remote or local attacker could trigger the overflow by supplying crafted input to the vulnerable module.