CVE-2026-76665

Executive Summary

CVE-2026-76665 is an out-of-bounds memory read vulnerability in HPE NonStop EXPAND, the networking and cluster interconnect layer of the HPE NonStop (Tandem) platform, which is classified as CWE-125 and described by the NVD as potentially resulting in a buffer overflow. The flaw is rated CVSS 7.1 (High) with an adjacent network attack vector, high attack complexity, no privileges required, and no user interaction, yielding low confidentiality but high integrity and high availability impact. No public proof-of-concept, exploit code, or Nuclei template exists, the issue is not in CISA KEV, and no vendor patch or workaround has been published by any tracked source.

Technical Analysis

CVE-2026-76665 affects HPE NonStop EXPAND. HPE NonStop EXPAND is the expand-over-* networking subsystem that provides inter-processor and inter-node communication on NonStop systems, allowing a cluster of processors or nodes to communicate over an interconnected fabric. Because EXPAND operates at a low layer beneath application and database workloads, memory-safety defects in this component are significant: the code path is reachable as part of normal inter-node traffic rather than only through high-level, authenticated application interfaces.

The NVD description states that the vulnerability "may cause out-of-bounds memory read resulting in buffer overflow." This maps to CWE-125 — Out-of-bounds Read. The precise mechanism is not disclosed in the available intelligence: the description does not name the affected function, message type, protocol field, or packet structure, and no CNA title or vendor advisory text was provided. Accordingly, the following analysis is confined to the vulnerability class and must not be read as a claim about specific internal implementation.

Out-of-bounds read failures (CWE-125) occur when code reads memory at an offset beyond the bounds of an allocated buffer, typically because an attacker-influenced length, index, offset, or count field is trusted without validation against the buffer's actual size. In an interconnect/networking component such as EXPAND, such fields normally arrive inside protocol messages or packet fragments. The victim process may then:

• Read adjacent heap or stack memory, disclosing data from neighboring allocations;
• Encounter an unmapped page, causing an access violation or process abnormal termination;
• Propagate a corrupted length or pointer into downstream logic, where an over-read may translate into an overwrite condition.

The NVD text explicitly links the out-of-bounds read to a buffer overflow outcome. This is consistent with a two-stage pattern: the over-read supplies or corrupts a value (for example a length or offset) that a subsequent copy or parse operation uses to perform an out-of-bounds write. The CVSS subscores support this interpretation. Availability is rated High (A:H), consistent with the possibility of a crash or resource exhaustion of the communications subsystem; Integrity is rated High (I:H), consistent with memory corruption that can alter program state or data; Confidentiality is rated Low (C:L), consistent with limited disclosure of adjacent memory.

The attack vector is Adjacent (AV:A), meaning the attacker must already be positioned on the same logical network segment, cluster fabric, or adjacent network path as the target. Attack complexity is High (AC:H), meaning exploitation is not reliable without specific knowledge of memory layout, message sequencing, or timing, and typically requires repeated attempts or environment-specific conditions. No privileges (PR:N) and no user interaction (UI:N) are required, so an adversary who can reach the EXPAND traffic path does not need credentials or a victim to open a file or link. Scope is Unchanged (S:U), indicating impact is bounded to the vulnerable component and not expected to cross a security authority boundary as scored.

No affected version range was reported by any tracked source, and no patch reference exists. That absence is itself operationally important: defenders cannot currently rely on a version string or advisory to determine exposure, and must treat this as an unpatched, uncharacterized memory-safety issue until HPE publishes guidance.

Exploitation Scenarios

No public proof-of-concept is available for CVE-2026-76665. The attack chain below is therefore inferred at the vulnerability-class level and does not rely on any function name, endpoint, or parameter — none were disclosed in the source data.

1. Reconnaissance and target identification. The attacker must first establish an adjacent network position. On a NonStop deployment, this means access to the same interconnect fabric or an adjacent network segment that can carry EXPAND traffic. Because the vector is AV:A rather than AV:N, internet- or WAN-origin exploitation is not the expected model; the realistic threat actors are insiders, a compromised peer node or adjacent host, a misconfigured network path, or a supply-chain/vendor access link that terminates on the same segment. The attacker fingerprints NonStop EXPAND traffic by observing the connectivity and protocol characteristics of the fabric.

2. Triggering the flaw class. Once traffic can be delivered to the EXPAND path, the attacker manipulates the input that reaches the vulnerable parsing logic. At the class level, out-of-bounds read is triggered by supplying a message containing a length, offset, count, or index value that is inconsistent with the actual buffer or payload size — for example, a declared length larger than the data carried, a negative or wrapped offset, or a truncated message that the parser continues to process. The High attack complexity reflects the requirement to shape these values correctly for the specific target build and memory layout. The attacker is not required to authenticate (PR:N) and does not need a victim to interact with anything (UI:N).

3. Execution and payload placement. Because the primitive is an over-read that the description connects to a buffer overflow, the attacker's objective is not merely to read memory but to leverage the malformed read state into an out-of-bounds write. At the class level, this typically follows one of two paths: (a) the over-read leaks adjacent memory contents, which the attacker uses to defeat address randomization or otherwise learn layout before a follow-on corruption attempt; or (b) the corrupted length or offset is consumed by a subsequent memory operation, producing a write beyond the destination buffer. The exact payload format is unknown and no exploit code has been published. Attempts are likely to require iteration, as the High complexity subscore implies unreliable single-shot success.

4. Post-exploitation impact. Successful corruption of the communications subsystem yields High availability impact — the EXPAND path, and by extension inter-node communications and dependent workloads, can be disrupted or crashed. High integrity impact indicates the attacker may be able to alter in-memory state in a way that affects processing outcomes. The Low confidentiality subscore limits the expected data disclosure but does not eliminate it; memory content from adjacent allocations could be exposed. Because the component sits beneath application workloads, cascading effects on clustered services, replication, and transaction processing are plausible, but the available data does not quantify them.

Impact Assessment

CVE-2026-76665 carries a CVSS 3.1 base score of 7.1 (High). The subscore profile is distinctive: AV:A (adjacent), AC:H (high complexity), PR:N (no privileges), UI:N (no user interaction), S:U (unchanged), C:L (low confidentiality), I:H (high integrity), A:H (high availability).

Business impact is driven primarily by the integrity and availability highs. A memory-corruption condition in the core inter-node communications layer of a NonStop platform puts at risk the availability of clustered processing, data replication, and interconnected application services. NonStop systems are frequently deployed for transaction processing, payments, and other high-availability workloads where unplanned interruption is both costly and operationally sensitive. A crash or degraded state in the interconnect can therefore create business-continuity impact disproportionate to the modest confidentiality rating.

Blast radius considerations: because the vector is adjacent rather than network-wide, exposure is bounded by segmentation quality and by who can reach the EXPAND traffic path. Environments with flat internal networks, shared management segments, or third-party connectivity into the same fabric have a materially larger effective blast radius than well-segmented deployments. The lack of an identified affected version range and the absence of any patch or workaround means every NonStop EXPAND deployment that plausibly runs the affected code should be treated as potentially exposed until HPE provides clarification.

No EPSS score has been assigned by FIRST.org, no CISA KEV listing exists, and no exploit code or template is publicly available. Exploitation, if it occurs, should currently be assessed as targeted and actor-specific rather than opportunistic and widespread.

Detection Guidance

Detection should focus on the adjacent network path, malformed or anomalous EXPAND-related traffic, and abnormal process behavior on NonStop nodes. Because no signature exists and the protocol internals were not disclosed, the rules below are deliberately written to detect exploitation patterns — malformed length fields, repeated connection attempts with unusual payload sizes, and crash/restart behavior — rather than a specific byte pattern. Analysts should tune heavily and treat all matches as leads, not confirmed exploitation.

Sigma Rule

title: Potential HPE NonStop EXPAND Out-of-Bounds Exploitation Attempt
id: 8f3c1a72-4b6e-4d21-9c07-2a5f0d9e7666
status: experimental
description: Detects anomalous process termination or restart patterns on HPE NonStop nodes consistent with memory corruption in the EXPAND interconnect subsystem (CVE-2026-76665). Requires host sensor or system log forwarding from NonStop nodes.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-76665
author: valtersit.com
date: 2026-01-01
tags:
  - attack.t1203
logsource:
  category: process_creation
  product: linux
detection:
  selection_expand:
    Image|contains:
      - 'expand'
      - 'EXPAND'
  selection_abnormal:
    EventType:
      - 'crash'
      - 'segfault'
      - 'abnormal_termination'
  selection_restart_loop:
    Keywords|contains:
      - 'restart'
      - 'core dump'
      - 'memory fault'
  condition: selection_expand and (selection_abnormal or selection_restart_loop)
falsepositives:
  - Scheduled restarts or planned maintenance of the EXPAND subsystem
  - Legitimate crash-bug reports unrelated to exploitation
level: medium

YARA Rule

rule CVE_2026_76665_NonStop_EXPAND_OOB_Memory_Corruption
{
    meta:
        description = "Heuristic detection of memory-corruption artifacts associated with CVE-2026-76665 in HPE NonStop EXPAND; targets crash dumps / core artifacts for over-read indicators"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-76665"
        date = "2026-01-01"
        cve = "CVE-2026-76665"
        severity = "high"

    strings:
        $exp1 = "EXPAND" ascii wide nocase
        $exp2 = "NonStop" ascii wide nocase
        $oob1 = "out-of-bounds" ascii wide nocase
        $oob2 = "buffer overflow" ascii wide nocase
        $mem1 = "memory fault" ascii wide nocase
        $mem2 = "invalid read" ascii wide nocase
        $mem3 = "core dump" ascii wide nocase

    condition:
        filesize < 50MB and
        ( ($exp1 or $exp2) and ($oob1 or $oob2 or $mem1 or $mem2 or $mem3) )
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-76665 HPE NonStop EXPAND malformed length field - possible out-of-bounds read attempt"; flow:established,to_server; dsize:<4; flags:S; threshold:type both, track by_src, count 10, seconds 30; classtype:attempted-admin; reference:cve,2026-76665; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-76665; sid:9007666; rev:1; metadata:service unknown, created_at 2026_01_01;)

alert tcp any any -> any any (msg:"CVE-2026-76665 HPE NonStop EXPAND repeated malformed oversized payload - possible buffer overflow trigger"; flow:established,to_server; dsize:>65000; threshold:type both, track by_src, count 20, seconds 60; classtype:attempted-admin; reference:cve,2026-76665; sid:9007667; rev:1; metadata:service unknown, created_at 2026_01_01;)

Note: no port or protocol field for EXPAND was disclosed, so the rules intentionally leave the port open and rely on flow state, direction, and payload-size anomalies. Restrict to the known fabric ports once baselined.

Elastic Detection

sequence by host.name with maxspan=5m
  [ process where process.name : ("expand", "EXPAND") and event.action == "start" ]
  [ process where process.name : ("expand", "EXPAND") and
      (event.action == "end" or event.action == "stop") and
      (process.exit_code != 0 or process.exit_code == null) ]

This EQL detects the start-then-abnormal-exit pairing that frequently accompanies memory-corruption crashes in a long-running interconnect process. Tune the process field names to the telemetry available from the NonStop host collector.

Splunk SPL Query

index=nonstop OR index=main sourcetype IN ("hpe:nonstop","nonstop:system","syslog")
("EXPAND" OR "EXPAND:")
(event_type="crash" OR event_type="abnormal_termination" OR message="*memory fault*" OR message="*buffer overflow*" OR message="*invalid read*" OR message="*core dump*")
| stats count min(_time) as first_seen max(_time) as last_seen values(message) as messages by host, process
| where count >= 3
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - count

Tune index and sourcetype to the local NonStop log ingestion pipeline. The count >= 3 threshold filters one-off, benign faults in favor of repeated instability.

Wazuh OSSEC Rule

<group name="hpe_nonstop,expand,cve-2026-76665,">
  <rule id="100666" level="10">
    <decoded_as>json</decoded_as>
    <match>EXPAND</match>
    <regex>memory fault|invalid read|buffer overflow|core dump|abnormal termination|segfault</regex>
    <description>CVE-2026-76665: Possible HPE NonStop EXPAND out-of-bounds memory corruption event detected</description>
    <mitre>
      <id>T1203</id>
    </mitre>
    <group>memory_corruption,</group>
  </rule>

  <rule id="100667" level="12" frequency="3" timeframe="300">
    <if_matched_sid>100666</if_matched_sid>
    <same_source_ip />
    <description>CVE-2026-76665: Repeated HPE NonStop EXPAND memory corruption events from same source - active exploitation suspected</description>
    <mitre>
      <id>T1203</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No vendor fix, no workaround, and no affected version range were available from any tracked source. The following guidance is therefore compensatory and architectural, not a substitute for a vendor patch. Obtain authoritative remediation directly from HPE support before relying on any of it.

1. Immediate mitigations

• Contact HPE support immediately to obtain the current security bulletin, affected product/module list, and any interim fix for CVE-2026-76665. Because no CVE-specific advisory data reached this report, treat HPE as the sole authoritative source.
• Reduce the adjacent attack surface. Restrict which hosts, network segments, and third-party links can reach EXPAND traffic. Apply strict ACLs and fabric-level segmentation so that only known peer nodes can exchange interconnect traffic on the relevant ports.
• Enforce least privilege on the internal network. Since PR:N applies, any reachable and compromised adjacent host is a potential source; harden adjacent hosts, patch them promptly, and remove unnecessary conduits into the NonStop fabric.
• Increase monitoring and backup frequency for affected nodes, and verify that service-recovery and failover procedures work for loss of the interconnect path.

2. Patch/upgrade steps

• Monitor the HPE Support Center security bulletin feed for a NonStop EXPAND fix referencing CVE-2026-76665. No patch reference is currently available.
• When a fix is released, validate it against the exact NonStop release and the specific EXPAND component in use, then schedule deployment during a maintenance window with a tested rollback plan.
• Re-test after each change; because no affected version range is published, do not assume an unpatched node is unaffected.

3. Long-term hardening

• Segment the cluster/interconnect fabric from general user and management networks on a permanent basis; this vulnerability class is far less reachable when adjacency is tightly controlled.
• Adopt compensating memory-safety controls where the platform and toolchain support them, and require memory-safety assurance (including static analysis and fuzzing of protocol parsers) in vendor and internal review processes for interconnect components.
• Maintain protocol-aware baselining of EXPAND traffic and alert on deviations in message sizes, sequencing, and rates so that malformed-field injection is detectable even without a published signature.
• Track HPE NonStop security advisories and maintain an inventory of NonStop nodes with their EXPAND connectivity paths so future advisories can be scoped to exposure quickly.

References

• NVD — CVE-2026-76665: https://nvd.nist.gov/vuln/detail/CVE-2026-76665
• CWE-125 — Out-of-bounds Read: https://cwe.mitre.org/data/definitions/125.html
• FIRST EPSS — CVE-2026-76665: not yet scored (https://api.first.org/data/v1/epss?cve=CVE-2026-76665)
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-76665 not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• HPE Support Center — NonStop security bulletins: https://support.hpe.com/ (search for NonStop EXPAND security advisories)

No public proof-of-concept, exploit code, Nuclei template, or threat-actor campaign has been observed for CVE-2026-76665. There is no exploit-in-the-wild evidence at the time of writing. Technical specifics beyond the vulnerability class — including exact affected functions, protocol fields, and affected versions — remain undisclosed.