The vulnerability permits an attacker to trigger an out-of-bounds memory read in HPE NonStop EXPAND. This flaw can allow the attacker to read unexpected memory contents, potentially exposing sensitive information stored in adjacent memory areas. The weakness is classified as an improper boundary check leading to information disclosure.

The affected product is Hewlett Packard Enterprise’s HPE NonStop EXPAND. Specific product version details are not enumerated in the advisory; the vulnerability applies to the range of releases covered by the HPE support note linked in the references.

The CVSS score of 4.7 indicates a moderate risk. No EPSS data and the vulnerability is not in the CISA KEV catalog, suggesting no known widespread exploitation. The attack surface is likely limited to entities with direct access to the NonStop EXPAND hardware or its management interfaces, and exploitation would require the ability to manipulate or observe the memory buffers within the application.