Skip to content
NewA calmer, faster ZeroHour
Vulnerability

CVE-2026-120008

Out-of-bounds write in SAP NetWeaver Internet Graphics Service

CVSS 3.1
8.2 high
EPSS
—
Published
·
Modified
Analyze CVE-2026-120008 with Vani AIImpact, affected versions, exploitation status, mitigations and detection
AI analysisSummaries by Vani AI

SAP NetWeaver Internet Graphics Service does not sufficiently validate certain values in incoming requests. An unauthenticated remote attacker can send a crafted request that triggers an out-of-bounds memory write in a worker process. Successful exploitation can corrupt memory or repeatedly terminate the process, with high impact on availability, low impact on integrity, and no impact on confidentiality.

What to do: Apply SAP's update for CVE-2026-120008. SAP has not listed a fixed version or workaround.

ProductAffected
SAP NetWeaver (Internet Graphics Service)—
Estimated exposure
No basis for an estimate.

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description · NVD

SAP NetWeaver (Internet Graphics Service) does not sufficiently validate certain input values within incoming requests. An unauthenticated user could send a specially crafted request to trigger an out-of-bounds memory write in a worker process. Successful exploitation could result in memory corruption or repeated termination of the affected process, resulting in a high impact on availability and a low impact on integrity with no impact on confidentiality.

Weakness
CWE-787
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
NVD CVE.org GitHub PoCs EPSS (—)

In the news

2 stories