CVE-2026-76664

Executive Summary

CVE-2026-76664 is a memory-safety vulnerability in HPE NonStop EXPAND that may result in out-of-bounds memory read and write operations. The flaw is classified as CWE-125 (Out-of-bounds Read) per the CNA assignment, although the NVD description explicitly states that both read and write operations may be affected. HPE NonStop systems running EXPAND — the proprietary network extension and routing subsystem used to interconnect NonStop nodes across geographically dispersed clusters — are affected.

The vulnerability carries a CVSS 3.1 base score of 6.4 (Medium) with the vector CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H, indicating that exploitation is possible from an adjacent network position, requires high attack complexity, needs no privileges or user interaction, and can result in low confidentiality and integrity impact with a high availability impact. No public proof-of-concept, exploit code, or Nuclei template exists, the CVE is not listed in CISA KEV, and no patch has been identified by any tracked source.

Technical Analysis

HPE NonStop EXPAND is a routing and network extension layer that interconnects NonStop servers, allowing applications on geographically separated nodes to communicate as if they were on the same local system. Because EXPAND operates at a low layer of the NonStop cluster fabric, memory-safety defects within it can be triggered by malformed network traffic originating from a system that can reach EXPAND communication paths.

The NVD description is deliberately terse: "A security vulnerability in HPE NonStop EXPAND may result in out-of-bounds memory read/write operations." This maps to CWE-125, Out-of-bounds Read, per the CNA's CWE assignment. The description additionally references out-of-bounds write behavior, which would normally correspond to CWE-787; readers should treat the CWE-125 tag as the officially assigned class while noting that the description explicitly covers both read and write primitives.

At the vulnerability-class level, an out-of-bounds memory access of this type occurs when a parser, buffer handler, or length-calculation routine fails to validate an index, offset, or size value before using it to address memory. Typical root causes include:

• Trusting a length or offset field embedded in network-supplied data without validating it against the actual buffer size.
• Off-by-one or integer-wraparound conditions in size arithmetic.
• Use of a pointer or index derived from untrusted input in a read or write operation.

Because the CNA title, NVD description, and vendor data provide no function names, message types, packet structures, or code paths, no specific parser, API, or field can be named. Any claim identifying a particular EXPAND subsystem routine, packet type, or parameter would be fabricated. What can be stated factually is that the attack surface is the EXPAND network communication path, and that the trigger is malformed or unexpected data reaching a memory-handling operation inside EXPAND.

The CVSS vector provides additional constraints consistent with this class:

• AV:A (Adjacent) — the attacker must be positioned on an adjacent network segment, i.e., able to send traffic toward an EXPAND endpoint, rather than being restricted to a fully remote internet path or requiring local access.
• AC:H (High) — successful exploitation is not trivial; the attacker must meet specific conditions (correct protocol framing, timing, or state) to reach the vulnerable operation reliably.
• PR:N / UI:N — no authentication and no user interaction are required.
• S:U — the impact is scoped to the vulnerable component.
• C:L / I:L / A:H — limited confidentiality and integrity exposure (consistent with reading or corrupting adjacent memory that the attacker may not fully control) and a high availability impact, consistent with a crash or node-level denial of service when the memory corruption destabilizes EXPAND.

Exploitation Scenarios

No public proof-of-concept or exploit code is available. The attack chain below is inferred strictly from the vulnerability class (out-of-bounds read/write via network-reachable memory handling) and the CVSS vector (adjacent network, high complexity, no privileges, no user interaction). No specific function names, packet types, endpoints, or parameters are asserted because none are present in the source data.

1. Reconnaissance and target identification. An attacker first identifies reachable HPE NonStop environments running EXPAND. This is typically an insider, a compromised adjacent host, or an actor with a foothold on a network segment that can route traffic to EXPAND communication paths. Fingerprinting relies on the presence of NonStop/EXPAND services and network topology rather than on the vulnerable component advertising a distinctive banner — no unique detector is documented.

2. Triggering the memory-safety condition. The attacker sends crafted or malformed traffic over the EXPAND communication path with the goal of reaching the vulnerable memory-handling operation. Given AC:H, the attacker likely needs to understand EXPAND framing and may need to induce a specific state or supply data that bypasses a length/offset check. The exact malformation is not documented; at the class level, the objective is to make EXPAND compute an address outside the bounds of an allocated buffer.

3. Payload and execution method. Because the description covers an out-of-bounds read/write, the immediate effect is likely to be one of two primitive types: (a) disclosure or corruption of memory adjacent to a buffer, or (b) a fault that terminates the EXPAND process or destabilizes the node. No reliable control-flow hijack is implied by the available data, and none should be assumed. There is no documented payload, no shellcode, and no public exploit.

4. Post-exploitation impact. Based on the CVSS subscores, the realistic outcomes are limited leakage or modification of data (C:L/I:L) and a high availability impact (A:H) — for example, a crash or denial of service affecting EXPAND and dependent NonStop communications. Any claim of full remote code execution, persistence, or lateral movement would exceed what the data supports.

Impact Assessment

Affected systems. HPE NonStop systems running EXPAND. No affected version range has been published, so organizations must inventory all EXPAND deployments and treat them as potentially affected until HPE confirms scope.

Business impact. EXPAND is a core interconnect for NonStop clusters. Degradation or failure of EXPAND can disrupt inter-node communication, transaction processing, and high-availability failover behavior — precisely the workloads NonStop is used for in financial services, payments, healthcare, and other availability-critical sectors. The high availability impact (A:H) in the CVSS vector is the dominant business risk.

Confidentiality and integrity. C:L and I:L indicate bounded exposure rather than a full compromise of the host. Nevertheless, memory disclosure could leak sensitive data residing near the affected buffer, and memory corruption could alter in-memory state.

Blast radius. Scope is Unchanged (S:U), meaning the immediate impact is confined to the vulnerable component. The practical blast radius depends on how many nodes rely on the affected EXPAND path and whether a crash triggers failover events that themselves cause service disruption. Because AV:A applies, external internet-wide exploitation is not indicated; the realistic threat is from adjacent-network positions, insider access, or a compromised host on the same segment.

Exploitability and urgency. AC:H and the absence of any public PoC, exploit code, or KEV listing reduce immediate likelihood of widespread exploitation. Patch confidence is 0/4: no vendor fix, advisory, or tracked patch evidence exists. This is a "monitor and mitigate" situation rather than an emergency patch event, but the absence of a workaround or fixed version should be treated as an unresolved risk for exposed NonStop estates.

Detection Guidance

Because no specific exploit artifacts, packet signatures, or code patterns are documented, the rules below target the vulnerability class — anomalous EXPAND-directed traffic and memory-fault behavior on NonStop hosts — and should be tuned to each environment. They are heuristic, not signature-perfect.

Sigma Rule

title: Potential HPE NonStop EXPAND Out-of-Bounds Exploitation Attempt
id: 3f6c1b2a-7d4e-4c9a-9b21-8e5f0a1c2d34
status: experimental
description: Detects anomalous process termination or crash behavior consistent with out-of-bounds memory access in HPE NonStop EXPAND (CVE-2026-76664). Heuristic; tune to environment.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-76664
author: valtersit.com Threat Intelligence
date: 2026/01/01
tags:
  - attack.t1211
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith:
      - '/expand'
      - '/expandd'
      - '/expandr'
  condition: selection
falsepositives:
  - Legitimate service restarts and scheduled maintenance
level: medium

YARA Rule

rule CVE_2026_76664_HPE_NonStop_EXPAND_OOB_Memory
{
    meta:
        description = "Heuristic rule to flag malformed EXPAND-oriented payloads containing oversized or inconsistent length fields. CVE-2026-76664 is CWE-125 class; no public PoC exists, so this rule is heuristic."
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-76664"
        author = "valtersit.com Threat Intelligence"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $exp = "EXPAND" ascii nocase
        $ns  = "NONSTOP" ascii nocase

    condition:
        uint16(0) != 0x5A4D and
        ($exp and $ns) and
        filesize < 100KB
}

Suricata IDS Rule

alert tcp any any -> any 10022 (msg:"CVE-2026-76664 HPE NonStop EXPAND potential malformed traffic - out-of-bounds read/write attempt"; flow:established,to_server; content:"EXPAND"; nocase; byte_test:2,>,8192,0,relative; threshold:type limit, track by_src, count 1, seconds 60; classtype:attempted-admin; reference:cve,2026-76664; sid:202676664; rev:1;)

Elastic Detection

process where event.type == "start" and
  process.name in ("expand", "expandd", "expandr") and
  process.parent.name != null

Splunk SPL Query

index=main (sourcetype=syslog OR sourcetype=ossec OR sourcetype=nonstop)
| search ("EXPAND" OR "expand") AND ("out of bounds" OR "out-of-bounds" OR "memory fault" OR "signal 11" OR "SIGSEGV" OR "buffer overflow")
| stats count min(_time) as first_seen max(_time) as last_seen by host src_ip process
| where count > 0
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="hpe_nonstop,expand,">
  <rule id="100766" level="10">
    <decoded_as>syslog</decoded_as>
    <match>EXPAND</match>
    <regex>out[- ]of[- ]bounds|memory fault|SIGSEGV|buffer overflow|core dump</regex>
    <description>CVE-2026-76664: Possible HPE NonStop EXPAND out-of-bounds memory access detected</description>
    <mitre>
      <id>T1211</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence from any tracked source.

1. Immediate mitigations.

   • Restrict network reachability to EXPAND communication paths using segmentation and ACLs so that only trusted NonStop nodes and authorized hosts can send traffic to EXPAND endpoints (directly counters the AV:A vector).
   • Monitor and alert on process termination, core dumps, or fault signals associated with the EXPAND process; treat repeated crashes as a potential exploitation indicator.
   • Where operationally feasible, isolate or rate-limit untrusted adjacent segments that can reach NonStop interconnect paths.
   • Engage HPE support to obtain a definitive affected-version matrix and timeline, since none is published.

2. Patch / upgrade steps.

   • No vendor fix is currently identified. Monitor the HPE NonStop security bulletins and the NVD entry for CVE-2026-76664 for an updated advisory and fixed release.
   • Once a fix is published, stage it in a test NonStop environment, validate EXPAND interconnect behavior and failover, then roll out during a maintenance window.
   • Given the A:H impact, prioritize high-availability nodes where EXPAND instability directly threatens service continuity.

3. Long-term hardening.

   • Apply defense-in-depth network segmentation around cluster interconnect fabrics.
   • Maintain an authoritative software inventory of EXPAND deployments and map them to HPE advisories.
   • Harden host monitoring to reliably detect memory-fault and crash telemetry on NonStop systems, and retain logs for post-incident analysis.
   • Track CISA KEV (currently not listed) and EPSS (currently unscored) for changes that would elevate priority.

References

1. NVD — CVE-2026-76664: https://nvd.nist.gov/vuln/detail/CVE-2026-76664
2. MITRE CWE-125 — Out-of-bounds Read: https://cwe.mitre.org/data/definitions/125.html
3. MITRE ATT&CK — T1211 Exploitation for Defense Evasion: https://attack.mitre.org/techniques/T1211/
4. HPE Security Bulletin library (monitor for NonStop EXPAND advisory): https://support.hpe.com/
5. CISA Known Exploited Vulnerabilities Catalog (CVE-2026-76664 not currently listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaigns or exploit-in-the-wild evidence have been identified for CVE-2026-76664 at the time of writing. No public proof-of-concept, exploit code, or Nuclei template is available, and the CVE is not listed in CISA KEV.