CVE-2025-42971
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-07-08

Last updated on: 2025-07-08

Assigner: SAP SE

Description
A memory corruption vulnerability exists in SAPCAR allowing an attacker to craft malicious SAPCAR archives. When a high privileged victim extracts this malicious archive, it gets processed by SAPCAR on their system, resulting in out-of-bounds memory read and write. This could lead to file extraction and file overwrite outside the intended directories. This vulnerability has low impact on the confidentiality, integrity and availability of the application.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-07-08
Last Modified
2025-07-08
Generated
2026-05-27
AI Q&A
2025-07-08
EPSS Evaluated
2026-05-25
NVD
CVE-2025-42971
EUVD
EUVD-2025-20338
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
sap sapcar 3.1
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability is a memory corruption issue in SAPCAR that allows an attacker to create malicious SAPCAR archives. When a user with high privileges extracts such a malicious archive, SAPCAR processes it and performs out-of-bounds memory reads and writes. This can cause files to be extracted or overwritten outside the intended directories.


How can this vulnerability impact me? :

The vulnerability can lead to unauthorized file extraction and overwriting outside intended directories when a high privileged user extracts a malicious SAPCAR archive. However, it has a low impact on the confidentiality, integrity, and availability of the application.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart