CVE-2026-120010: Memory Corruption vulnerability in SAP NetWeaver Application Server (SAP Message Server)
SAP NetWeaver Application Server (SAP Message Server) does not properly size memory allocations when handling certain HTTP requests. An unauthenticated attacker could send a specially crafted request to trigger a heap buffer overflow in affected functionality. Successful exploitation causes the component to abort and remain unavailable until it is restarted by the framework, resulting in a high impact on availability of the system. There is no impact on confidentiality and integrity of the application.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated attacker who can reach the affected SAP Message Server over the network can send a specially crafted HTTP request. No user interaction or prior privileges are required.
What is the likely impact of successful exploitation?
Successful exploitation causes the affected component to abort and remain unavailable until the framework restarts it. The provided information identifies availability impact only, with no confidentiality or integrity impact.
What can be done if patching is not immediately possible?
The available information does not provide a specific workaround. Reducing untrusted network access to the affected HTTP functionality can limit exposure, but this is not stated as a vendor-provided mitigation.