Memory corruption in HPE NonStop SOAP 4.0 can cause the SOAP service to crash, resulting in a complete system shutdown. The flaw permits malicious manipulation of data structures and may lead to arbitrary memory overwrite, a classic vulnerability described by CWE‑20. Without proper bounds checking of incoming SOAP messages, this bug can be triggered by malformed requests, leading to denial‑of‑service and extended downtime for critical workloads.

Hewlett‑Packard Enterprise’s NonStop SOAP 4.0 platform is vulnerable. The advisory does not list sub‑versions, so every 4.0 release is considered affected. The flaw may impact any system running SOAP 4.0 on supported hardware, regardless of configuration.

The CVSS score of 8.2 signals high severity, while the EPSS score of less than 1% indicates a very low probability of exploitation in the wild. The flaw is not listed in CISA’s KEV catalog, suggesting no known active exploitation campaigns. It is inferred that a remote attacker would need to identify the SOAP endpoint and deliver a crafted request that triggers the memory corruption, causing the service to terminate unexpectedly. The lack of product‑side mitigations underscores the importance of applying the vendor’s fix promptly.