Hpe Nonstop Expand
Monthly
Out-of-bounds memory reads in HPE NonStop EXPAND - the networking subsystem of HPE's NonStop fault-tolerant server platform - can expose process memory contents and crash the EXPAND process, giving an adjacent-network attacker both information disclosure and a denial-of-service path. Exploitation requires network adjacency to a NonStop system's EXPAND communication path rather than arbitrary internet reach, no authentication or user interaction is needed, but high attack complexity means success depends on hard-to-control timing and process-state conditions, so reliable exploitation is unlikely. No public exploit code and no confirmed active exploitation have been identified at time of analysis, and the EPSS signal (not provided) is not a driver here; practical risk is further bounded by the platform's narrow deployment footprint and the fact that EXPAND links normally sit on segmented internal or interconnect networks.
An out-of-bounds memory read in HPE NonStop EXPAND can be triggered by an authenticated, highly privileged local operator on the NonStop platform, potentially leaking memory contents or destabilizing the EXPAND networking subsystem. Exploitation requires local access (AV:L), pre-existing high privileges (PR:H), and a hard-to-control memory or timing condition (AC:H), so it is neither remotely nor anonymously reachable; no user interaction is required. No public exploit code has been identified at time of analysis, and the vendor security bulletin (hpesbns05148en_us) is the authoritative source for affected releases and fixes.
Out-of-bounds memory read in HPE NonStop EXPAND can disclose sensitive information to a local attacker who already holds high privileges on the NonStop system. The flaw requires local access and high privilege with high attack complexity, so realistic exploitation is limited to malicious or compromised privileged operators rather than external or unauthenticated attackers. No public exploit identified at time of analysis, and the CVSS 3.1 score is 4.7 (AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:L), consistent with a low-priority information-disclosure issue.
Out-of-bounds memory read and write operations in HPE NonStop EXPAND can be triggered by malformed traffic sent to the EXPAND networking subsystem, potentially leading to information disclosure or memory corruption. The vulnerability is rated CVSS 6.4 (AV:A/AC:H/PR:N/UI:N) - an attacker needs an adjacent-network position and no credentials, but exploitation depends on specific, attacker-uncontrolled memory or timing conditions, which keeps this at moderate rather than critical severity. No public exploit code or active exploitation has been identified at time of analysis; remediation guidance should be taken from the HPE security bulletin.
Out-of-bounds memory reads in HPE NonStop EXPAND - the networking subsystem of HPE's NonStop fault-tolerant server platform - can expose process memory contents and crash the EXPAND process, giving an adjacent-network attacker both information disclosure and a denial-of-service path. Exploitation requires network adjacency to a NonStop system's EXPAND communication path rather than arbitrary internet reach, no authentication or user interaction is needed, but high attack complexity means success depends on hard-to-control timing and process-state conditions, so reliable exploitation is unlikely. No public exploit code and no confirmed active exploitation have been identified at time of analysis, and the EPSS signal (not provided) is not a driver here; practical risk is further bounded by the platform's narrow deployment footprint and the fact that EXPAND links normally sit on segmented internal or interconnect networks.
An out-of-bounds memory read in HPE NonStop EXPAND can be triggered by an authenticated, highly privileged local operator on the NonStop platform, potentially leaking memory contents or destabilizing the EXPAND networking subsystem. Exploitation requires local access (AV:L), pre-existing high privileges (PR:H), and a hard-to-control memory or timing condition (AC:H), so it is neither remotely nor anonymously reachable; no user interaction is required. No public exploit code has been identified at time of analysis, and the vendor security bulletin (hpesbns05148en_us) is the authoritative source for affected releases and fixes.
Out-of-bounds memory read in HPE NonStop EXPAND can disclose sensitive information to a local attacker who already holds high privileges on the NonStop system. The flaw requires local access and high privilege with high attack complexity, so realistic exploitation is limited to malicious or compromised privileged operators rather than external or unauthenticated attackers. No public exploit identified at time of analysis, and the CVSS 3.1 score is 4.7 (AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:L), consistent with a low-priority information-disclosure issue.
Out-of-bounds memory read and write operations in HPE NonStop EXPAND can be triggered by malformed traffic sent to the EXPAND networking subsystem, potentially leading to information disclosure or memory corruption. The vulnerability is rated CVSS 6.4 (AV:A/AC:H/PR:N/UI:N) - an attacker needs an adjacent-network position and no credentials, but exploitation depends on specific, attacker-uncontrolled memory or timing conditions, which keeps this at moderate rather than critical severity. No public exploit code or active exploitation has been identified at time of analysis; remediation guidance should be taken from the HPE security bulletin.