CVE-2026-76667

Executive Summary

CVE-2026-76667 is an out-of-bounds memory read vulnerability (CWE-125) in HPE NonStop EXPAND, a fault-tolerant networking and cluster interconnect service used on HPE NonStop (Tandem) systems. Per the supplied NVD description, exploitation "may result in out-of-bounds memory read," with a CVSS 3.1 base score of 5.7 (medium) reflecting a local attack vector, high attack complexity, and high privileges required, while scope is unchanged and confidentiality impact is rated None. Because EXPAND handles inter-node traffic in clustered NonStop deployments, a local attacker holding high privilege on a node could read adjacent memory, which in a shared-memory or kernel-adjacent context may expose sensitive data or corrupt integrity-relevant state, but no public proof-of-concept, exploit code, Nuclei template, or affected-version list is currently available.

Technical Analysis

The vulnerability class is an out-of-bounds read (CWE-125). The NVD description states only that the flaw exists in HPE NonStop EXPAND and that it "may result in out-of-bounds memory read." No function names, message parsers, buffer indices, or specific protocol fields are identified in the source data, so the following describes the general mechanism for this vulnerability class without attributing invented code artifacts.

An out-of-bounds read occurs when software computes an address or length that exceeds the bounds of the buffer, array, or message that the pointer was intended to reference. In a system service such as EXPAND, typical root causes include:

• Missing or insufficient validation of a length, count, or index field before it is used in a copy, comparison, or lookup.
• Arithmetic error (overflow/underflow) in a bounds check that causes the check to pass when it should fail — the canonical pattern for CWE-125, which NVD associates with "the product reads data past the end, or before the beginning, of the intended buffer."
• Discrepancy between the size of data received and the size assumed by the consumer of that data.

The attack surface is the local interface through which a privileged process interacts with EXPAND. The CVSS vector AV:L/AC:H/PR:H/UI:N indicates that exploitation requires local access, is not reliably reproducible (high complexity), and requires high privileges; no user interaction is needed and scope remains Unchanged. The C:N/I:H/A:H subvector carries an unusual combination for a "pure" out-of-bounds read — integrity and availability are rated High while confidentiality is rated None. In practice, an out-of-bounds read on a memory-mapped interface can do more than disclose data: repeated reads near unmapped pages can raise processor faults that terminate or wedge the service, and reads that land in a structure shared with integrity-sensitive state can perturb it. Analysts should treat the NVD description as authoritative and confirm the concrete mechanism against HPE's advisory once published; the description is insufficiently detailed to specify the exact code path.

The affected protocol/interface is EXPAND itself. No version data is published, and no OSV package mapping exists (OSV Packages: N/A), so remediation must be driven by the vendor advisory.

Exploitation Scenarios

The following attack chain is derived strictly from the vulnerability class and the CVSS vector; no public PoC exists and no specific message format, function, or API is asserted.

1. Reconnaissance / target identification. An attacker who already has a foothold on an HPE NonStop node (or adjacent access as a highly privileged local user, per PR:H) enumerates services and confirms that EXPAND is present and reachable over the local interface. Because EXPAND is an interconnect/cluster service, identifying a clustered node and its topology is the primary reconnaissance objective. No network scanning of a public attack surface applies — the vector is local only (AV:L).

2. Triggering the flaw. The attacker supplies input to the EXPAND interface that causes a length, index, or count value to fall outside the valid range for the referenced buffer. In CWE-125 terms, the consumer reads beyond the intended buffer because the bounds check is missing, insufficient, or satisfiable via integer arithmetic error. Reproduction is non-trivial (AC:H), consistent with a race, a state-dependent condition, or a value that only a narrow slice of legitimate inputs can reach — but the exact trigger cannot be stated from the provided data.

3. Execution method. At the vulnerability-class level, this is not remote code execution; it is an information-integrity/availability primitive. The attacker drives the out-of-bounds read and observes the service behavior (crashes, restarts, anomalous diagnostics). If the read lands in memory holding sensitive control data, the integrity impact in the CVSS score (I:H) may reflect the service acting on values the attacker influenced; if the read walks into an inaccessible page, the resulting fault produces the availability impact (A:H). No payload-staging detail can be asserted without vendor confirmation.

4. Post-exploitation impact. Within the local, high-privilege context required, the attacker may obtain adjacent memory contents (information exposure) or force a fault that degrades or halts EXPAND — affecting cluster communication and, in a NonStop environment, the reliability guarantees the platform is designed to provide. Cascading effect on dependent nodes is plausible but unconfirmed. Transfer of any recovered data is limited by the same local-access prerequisite.

No public PoC is available; the attack chain is inferred from the vulnerability class (CWE-125) and the CVSS vector.

Impact Assessment

CVSS 3.1 base score 5.7 (Medium): AV:L / AC:H / PR:H / UI:N / S:U / C:N / I:H / A:H. The score is driven primarily by the integrity and availability impact. Blast radius is confined to a node and its EXPAND communications within the cluster (S:U). Business impact depends on the role the affected NonStop system plays: a node running transaction processing, payments, or other HA-critical workloads that loses EXPAND communication may trigger failover, transaction retries, or service degradation. Because the confidentiality impact is rated None, targeted data theft is not the primary concern at this scoring; operational disruption and integrity perturbation of cluster state dominate. No EPSS score is available (not yet scored by FIRST.org), and the vulnerability is not in CISA KEV, so there is no known active exploitation in the wild. Exposure is severely constrained by the AV:L and PR:H requirements: an attacker must already hold high privilege locally, which materially limits mass exploitation.

Detection Guidance

Sigma Rule

title: Out-of-Bounds Read Attempt Against HPE NonStop EXPAND (CVE-2026-76667)
id: 8f2c1a44-6b7e-4d19-9a3c-0f5e7b21c9d0
status: experimental
description: Detects local, high-privilege interaction with HPE NonStop EXPAND processes consistent with CVE-2026-76667 out-of-bounds read attempts.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-76667
author: valtersit.com
logsource:
  product: hpe_nonstop
  service: audit
detection:
  selection_process:
    Image|endswith:
      - 'expand'
      - 'EXPAND'
  selection_priv:
    Privilege|contains:
      - 'SUPER'
      - 'root'
      - 'GOD'
  selection_anomaly:
    EventID:
      - 1100
      - 1101
      - 1102
    Message|contains:
      - 'signal'
      - 'ABEND'
      - 'memory fault'
      - 'bounds'
  condition: selection_process and selection_priv and selection_anomaly
falsepositives:
  - Legitimate maintenance and diagnostic tooling run by super.users
  - Planned EXPAND process restarts during node failover
level: medium
tags:
  - attack.t1211
  - cve.2026.76667

YARA Rule

rule CVE_2026_76667_HPE_NonStop_EXPAND_OOB_Read
{
    meta:
        description = "Detects HPE NonStop EXPAND binaries/process images that may be affected by CVE-2026-76667 (out-of-bounds read, CWE-125)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-76667"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $expand1 = "EXPAND" ascii wide nocase
        $expand2 = "expand" ascii wide nocase
        $hpnonstop = "NonStop" ascii wide nocase
        $tandem = "Tandem" ascii wide nocase
        $cve = "CVE-2026-76667" ascii wide

    condition:
        (
            (uint16(0) == 0x5A4D or uint32(0) == 0x464C457F) and
            any of ($expand*) and
            any of ($hpnonstop, $tandem)
        )
        or any of ($cve)
}

Suricata IDS Rule

alert ip any any -> any any (msg:"valtersit.com - HPE NonStop EXPAND out-of-bounds read attempt (CVE-2026-76667)"; flow:to_server; content:"EXPAND"; nocase; depth:64; threshold:type both, track by_src, count 20, seconds 60; reference:cve,2026-76667; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-76667; classtype:attempted-recon; sid:202676667; rev:1;)

Note: because the CVSS vector is AV:L (local), this network signature can only fire where EXPAND traffic crosses a monitored segment (for example, cluster interconnect or loopback mirrored to a sensor). It is a supplementary control, not a primary detection.

Elastic Detection

process where event.category == "process" and
  process.name : ("expand", "EXPAND") and
  (
    process.args : ("*probe*", "*diagnose*", "*dump*", "*inject*") or
    event.action == "signal" or
    process.exit_code : (139, 134)
  )

Splunk SPL Query

index=hpe_nonstop sourcetype=nonstop:audit (process=EXPAND OR process=expand)
  (Message="*ABEND*" OR Message="*memory fault*" OR Message="*signal*" OR Message="*invalid length*")
| stats count min(_time) as first_seen max(_time) as last_seen values(Message) as messages by host user pid
| where count > 5
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="hpe_nonstop,expand,">
  <rule id="202676667" level="8">
    <decoded_as>nonstop-audit</decoded_as>
    <match>EXPAND|expand</match>
    <regex>ABEND|memory fault|invalid length|out of bounds</regex>
    <description>CVE-2026-76667: Possible out-of-bounds read attempt against HPE NonStop EXPAND</description>
    <mitre>
      <id>T1211</id>
    </mitre>
    <options>no_full_log</options>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

• Enforce least privilege on NonStop nodes: restrict accounts with the high privileges required by PR:H. Remove or tightly scope super-user group membership and audit all privilege escalations.
• Restrict local interactive and programmatic access to EXPAND processes; use allow-listed maintenance windows and monitor diagnostic tooling invocations.
• Where operationally feasible, isolate cluster interconnect segments so that only expected node-to-node traffic is present, and mirror that segment to IDS for the supplementary Suricata signature above.
• Increase audit verbosity for EXPAND process lifecycle events (starts, abnormal exits, ABEND/faults) and feed HPE NonStop audit records into Splunk/Wazuh/Elastic for the queries above.

2. Patch / upgrade steps

• No vendor fix is published in the supplied data. Monitor HPE support advisories for the HPE NonStop EXPAND bulletin corresponding to CVE-2026-76667 and apply the vendor-issued corrected component or OS update when available.
• Track the NVD entry for updates to the affected-version list (currently empty), references, and any revised CNA description.
• Do not treat this report as patch guidance beyond the above; the absence of patch evidence is itself the finding.

3. Long-term hardening

• Adopt compiler and runtime memory-safety controls where the NonStop toolchain supports them, and enforce input-length validation on all service interfaces as a coding standard.
• Periodically review the use of bounds checks and integer arithmetic in service code to close the CWE-125 pattern class.
• Maintain an asset inventory of clustered NonStop nodes so that advisories can be mapped to affected systems quickly.
• Reassess EPSS and CISA KEV status as data becomes available; both are currently absent/negative.

References

• NVD Entry — CVE-2026-76667: https://nvd.nist.gov/vuln/detail/CVE-2026-76667
• CWE-125: Out-of-bounds Read — https://cwe.mitre.org/data/definitions/125.html
• NVD CWE dictionary entry for CWE-125: https://nvd.nist.gov/vuln/categories
• HPE Support Center — product advisories and security bulletins (search for NonStop EXPAND): https://support.hpe.com/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-76667 not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-76667 in the supplied data; the vulnerability is not in CISA KEV, no PoC or exploit code has been observed, and no EPSS score has been published.