HPE NonStop EXPAND EUVD-2026-101827

Exploitation requires LOCAL access to an HPE NonStop system (AV:L) AND pre-existing HIGH privileges (PR:H) - this is a post-authentication, privileged-context flaw in the EXPAND networking subsystem, not a remote or unauthenticated vector. The HIGH attack complexity (AC:H) indicates the out-of-bounds read depends on a specific memory layout or timing condition that the attacker does not fully control, limiting reliability. No user interaction is needed (UI:N). The practical limiting factors - local access plus high privilege plus non-trivial triggering conditions - confine realistic exploitation to malicious or compromised privileged operators rather than external attackers.

This is a genuinely low-priority issue despite its MEDIUM CVSS of 4.7. The CVSS 3.1 vector (AV:L/AC:H/PR:H/UI:N) is highly constraining: an attacker needs LOCAL access, must already hold HIGH privileges on the HPE NonStop host, and must overcome HIGH attack complexity (specific conditions/race or memory-state dependencies typical of an out-of-bounds read). The single notable impact is confidentiality (C:H) - consistent with CWE-125 information disclosure via memory over-read - with no integrity impact (I:N) and only low availability impact (A:L, likely a potential crash). No EPSS score, KEV listing, or public POC is present in the input, so there is no signal of exploitation activity; exploitation status is therefore 'no public exploit identified at time of analysis.' The signals are internally consistent (no CVSS-vs-description conflict), and all point the same direction: a privileged-insider / post-compromise memory-disclosure flaw rather than a remotely weaponizable one. The main caveat is data sparseness - a single HPE advisory reference and no independent corroboration - but nothing contradicts the low real-world risk conclusion.

An attacker who has already obtained a high-privilege account on an HPE NonStop system interacts with the EXPAND networking subsystem in a way that triggers the out-of-bounds read, causing adjacent process memory to be returned or exposed. Under the right conditions this leaks sensitive in-memory data (credentials, keys, or transaction content); no public exploit code is known, and the high attack complexity means reliable triggering is non-trivial.