CVE-2026-109806: Multiple Vulnerabilities in SAP NetWeaver (Internet Graphics Service)
SAP NetWeaver (Internet Graphics Service) does not sufficiently validate certain input values within incoming requests. An unauthenticated user could send a specially crafted request containing malformed image data, triggering an integer overflow that leads to repeated termination of the worker process. This results in a high impact on availability with no impact on integrity or confidentiality.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated remote user can exploit it by sending a specially crafted request containing malformed image data to the affected Internet Graphics Service.
What is the expected impact of a successful attack?
Successful exploitation can repeatedly terminate the worker process, causing a high availability impact. The provided information indicates no confidentiality or integrity impact.
What should be prioritized for mitigation?
Prioritize applying the SAP security guidance referenced in SAP Note 3809934. The available data does not specify a workaround or affected version range.