HPE NonStop EXPAND CVE-2026-76667

Exploitation requires local access to the HPE NonStop platform (AV:L) and pre-existing high privileges (PR:H) - i.e., the attacker must already be an authenticated, privileged operator interacting with the EXPAND networking subsystem; it is not remotely or anonymously reachable. The high attack complexity (AC:H) further limits exploitation, indicating the out-of-bounds read depends on specific, hard-to-control memory state or timing rather than a deterministic trigger. No user interaction is required (UI:N). The description does not name a specific non-default configuration, so the condition appears to be reaching the vulnerable EXPAND code path with the required privilege level rather than enabling an optional feature.

This is a moderate, lower-priority issue rather than an urgent threat. The CVSS 3.1 vector (AV:L/AC:H/PR:H/UI:N/S:U) describes a constrained attack: local access only, high attack complexity, and high privileges already required - meaning an attacker must first be an authenticated, privileged operator on the HPE NonStop system before this becomes relevant. No EPSS score, CISA KEV listing, SSVC decision data, or public POC was provided, and none is implied by the single HPE advisory reference, so there is no signal of active or probable exploitation. One internal inconsistency must be flagged: the CWE is CWE-125 (out-of-bounds read) and the tags include 'Information Disclosure,' yet the supplied CVSS vector sets C:N (no confidentiality impact) while asserting I:H and A:H (high integrity and availability impact). An out-of-bounds READ normally yields confidentiality/availability impact, not integrity impact, so the vendor-supplied impact metrics appear mismatched with the vulnerability class - verify the impact breakdown with HPE. Taken together, the combination of local vector, high privilege requirement, high complexity, and absence of exploitation evidence makes this a routine patch-on-schedule item for the niche population of NonStop operators, not a high-real-risk emergency.

An attacker who already holds privileged (operator-level) access to an HPE NonStop system locally interacts with the EXPAND networking subsystem in a way that triggers an out-of-bounds memory read, potentially disclosing adjacent process memory or crashing the affected component. The high attack complexity (AC:H) implies the condition is not reliably reproducible and may require specific timing or state. No public exploit code was identified at time of analysis.