The flaw is an unauthenticated adjacent buffer overflow that permits attackers to inject and execute arbitrary code on a vulnerable HPE system. By sending specially crafted input to the affected component, an attacker can overflow memory boundaries and gain code execution with system privileges. The vulnerability stems from improper handling of input boundaries, allowing the local buffer to be overwritten and control flow redirected.

Hewlett Packard Enterprise products are impacted, although specific product names and version ranges are not disclosed. Any HPE system that incorporates the vulnerable component is at risk, regardless of the operating environment.

The CVSS score of 9.6 indicates critical severity. The EPSS score is not available, so the current exploitation probability cannot be quantified, but the vulnerability is listed as not in the KEV catalog. The lack of required authentication and the ability to achieve remote code execution make this a high‑risk issue that could be leveraged by a wide range of adversaries.