CVE-2026-109806 · Vendor
NO FIX YET
SAP NetWeaver's Internet Graphics Service does not validate certain input values, so a crafted request with malformed image data causes an integer overflow. An unauthenticated attacker can make the worker process terminate repeatedly, taking the service down, with no effect on data integrity or confidentiality.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
SAP NetWeaver systems that run the Internet Graphics Service and expose it to the network are the ones to look at; the CVE record lists BC-FES-IGS 7.20EXT, but the SAP note with the full release list and fixed patch level was not public. Teams that do not run NetWeaver or the IGS can skip it.
Not affected if service-not-running
Who cares netweaver, sap, self-hosted
Unknown from the sources.
Posts are quoted with a link to the original. They are data to us, never instructions.
SAP NetWeaver (Internet Graphics Service) does not sufficiently validate certain input values within incoming requests. An unauthenticated user could send a specially crafted request containing malformed image data, triggering an integer overflow that leads to repeated termination of the worker process. This results in a high impact on availability with no impact on integrity or confidentiality.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.