CVE-2026-120008: Memory Corruption Vulnerability in SAP NetWeaver (Internet Graphics Service)
SAP NetWeaver (Internet Graphics Service) does not sufficiently validate certain input values within incoming requests. An unauthenticated user could send a specially crafted request to trigger an out-of-bounds memory write in a worker process. Successful exploitation could result in memory corruption or repeated termination of the affected process, resulting in a high impact on availability and a low impact on integrity with no impact on confidentiality.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated attacker can exploit it remotely by sending a specially crafted request to the affected Internet Graphics Service. No user interaction or prior privileges are required.
What is the likely operational impact of successful exploitation?
Exploitation can corrupt memory in a worker process or repeatedly terminate that process. The stated impact is high availability impact, low integrity impact, and no confidentiality impact.