The flaw in HPE NonStop SQL/MX Run‑Time Statistics can cause memory corruption followed by a null pointer dereference. This leads to process crashes that manifest as denial of service and, if the corruption occurs within the statistics gathering code, may leak sensitive data. The weakness is an improper input validation issue (CWE‑20).

Affected systems are installations of Hewlett Packard Enterprise's HPE NonStop SQL/MX Run‑Time Statistics. No specific versions are identified, so every deployment should be treated as potentially vulnerable until an official fix is applied.

The CVSS score of 6.4 indicates moderate severity, while the EPSS score of less than 1% reflects a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, and no widespread exploitation has been reported. Based on the description, it is inferred that an attacker would need some form of access to the Run‑Time Statistics service, but the required privilege level (local or network) is not explicitly stated.