A crafted input message triggers a buffer overflow in the HPE Nonstop KMS Server, potentially leading to memory corruption and unknown system instability. The vulnerability is classified as CWE-20, indicating an input validation weakness. This flaw could allow an attacker to cause a denial of service, although the current CVSS score indicates a low likelihood of widespread impact.

The affected vendor is Hewlett Packard Enterprise, with the product HPE Nonstop KMS Server. No specific version information is provided, so all deployments of this product may be susceptible until a vendor patch is applied.

The CVSS score of 2.8 reflects a low severity, and the EPSS score of less than 1 percent indicates a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, and no exploits are publicly documented. Based on the description, the likely attack vector is remote input sent over the network to the KMS service, but this is inferred as the description does not explicitly detail the vector.