CVE-2026-120008
Received Received - Intake

Memory Corruption in SAP NetWeaver Internet Graphics Service

Publication date: 2026-11-10

Last updated on: 2026-11-10

Assigner: SAP SE

Description
SAP NetWeaver (Internet Graphics Service) does not sufficiently validate certain input values within incoming requests. An unauthenticated user could send a specially crafted request to trigger an out-of-bounds memory write in a worker process. Successful exploitation could result in memory corruption or repeated termination of the affected process, resulting in a high impact on availability and a low impact on integrity with no impact on confidentiality.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-10
Last Modified
2026-11-10
Generated
2026-11-10
AI Q&A
2026-11-10
EPSS Evaluated
N/A
NVD
CVE-2026-120008
EUVD
EUVD-2026-120694

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
sap netweaver *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in SAP NetWeaver's Internet Graphics Service. It allows an unauthenticated attacker to send a specially crafted request that triggers an out-of-bounds memory write in a worker process. This can cause memory corruption or repeated process crashes, affecting system availability.

Detection Guidance

Detecting this vulnerability requires monitoring for unusual network traffic or process crashes related to SAP NetWeaver's Internet Graphics Service. Check for repeated crashes of the affected worker process or unexpected memory corruption events. Use network monitoring tools to inspect incoming requests to the service for malformed or crafted input patterns.

Impact Analysis

Exploitation could lead to memory corruption or repeated termination of the affected process. This results in high impact on system availability, low impact on data integrity, and no impact on confidentiality. Systems may become unstable or crash repeatedly.

Compliance Impact

This vulnerability impacts availability and integrity but does not directly affect confidentiality. GDPR requires protecting personal data confidentiality, so the low integrity impact may not directly violate GDPR unless data corruption occurs. HIPAA focuses on confidentiality and integrity of health data; the low integrity impact could pose compliance risks if data is altered. Overall, the primary compliance concern is potential service disruption due to process termination.

Mitigation Strategies

Apply the latest security patches from SAP immediately. Restrict network access to the Internet Graphics Service to trusted sources only. Monitor the service for crashes or memory corruption events. Consider disabling the service if not in use until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-120008. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...