{"id":"CVE-2026-109806","kind":"vulnerability","aliases":["CVE-2026-109806"],"related":[],"title":"SAP NetWeaver: crafted image request crashes Internet Graphics Service worker repeatedly","description":"SAP NetWeaver (Internet Graphics Service) does not sufficiently validate certain input values within incoming requests. An unauthenticated user could send a specially crafted request containing malformed image data, triggering an integer overflow that leads to repeated termination of the worker process. This results in a high impact on availability with no impact on integrity or confidentiality.","summary":"SAP NetWeaver's Internet Graphics Service does not validate certain input values, so a crafted request with malformed image data causes an integer overflow. An unauthenticated attacker can make the worker process terminate repeatedly, taking the service down, with no effect on data integrity or confidentiality.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["netweaver","sap","self-hosted","vendor"],"not_affected_if":["service-not-running"],"how_to_check":"Check whether the SAP Internet Graphics Service (IGS, component BC-FES-IGS) runs in your landscape (the igswd process / IGS instance), then look up CVE-2026-109806 in SAP for Me Security Notes for the affected release and patch level. The CVE record lists BC-FES-IGS 7.20EXT; the fixed patch level is unknown until the SAP note is read.","fix":null,"status":"open","published_at":"2026-11-10T01:17:14+00:00","first_seen_at":"2026-11-10T01:26:38+00:00","triaged_at":"2026-11-10T01:28:38+00:00","updated_at":"2026-11-10T01:34:57+00:00","category":"vendor","confidence":0.5,"triage":{"at":"2026-11-10T01:28:38Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"SAP NetWeaver: crafted image request crashes Internet Graphics Service worker repeatedly","impact":"low","summary":"SAP NetWeaver's Internet Graphics Service does not validate certain input values, so a crafted request with malformed image data causes an integer overflow. An unauthenticated attacker can make the worker process terminate repeatedly, taking the service down, with no effect on data integrity or confidentiality.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["sap","netweaver","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"repeated worker crashes cause denial of service on the graphics service","analyst_note":"Check the SAP Security Note for CVE-2026-109806 at the NVD link for affected releases, patch level and fixed versions; the sources give none.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["service-not-running"],"who_is_affected":"SAP NetWeaver systems that run the Internet Graphics Service are the exposed ones; the sources do not say which releases or patch levels are affected, or whether the service is enabled by default. Teams that do not run NetWeaver, or do not run this service, can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000704,"input_tokens":4568,"output_tokens":495,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the SAP Security Note for CVE-2026-109806 at the NVD link for affected releases, patch level and fixed versions; the sources give none.","search":"'-109806':14A,17A '-2026':13A,16A 'attack':50B 'avail':118C 'caus':44B 'certain':33B,79C 'confidenti':69B,125C 'contain':94C 'could':88C 'craft':3A,38B,92C 'crash':6A 'cve':12A,15A 'data':43B,66B,97C 'effect':64B 'graphic':8A,28B,73C 'high':115C 'host':22B 'imag':4A,42B,96C 'impact':116C,121C 'incom':83C 'input':34B,80C 'integ':46B,100C 'integr':67B,123C 'internet':7A,27B,72C 'lead':103C 'make':52B 'malform':41B,95C 'netweav':2A,18B,25B,71C 'overflow':47B,101C 'process':55B,110C 'repeat':11A,57B,105C 'request':5A,39B,84C,93C 'result':112C 'sap':1A,19B,24B,70C 'self':21B 'self-host':20B 'send':89C 'servic':9A,29B,60B,74C 'special':91C 'suffici':77C 'take':58B 'termin':56B,106C 'trigger':98C 'unauthent':49B,86C 'user':87C 'valid':32B,78C 'valu':35B,81C 'vendor':23B 'within':82C 'worker':10A,54B,109C","nicknames":[],"mitigations":[],"who_affected":"SAP NetWeaver systems that run the Internet Graphics Service and expose it to the network are the ones to look at; the CVE record lists BC-FES-IGS 7.20EXT, but the SAP note with the full release list and fixed patch level was not public. Teams that do not run NetWeaver or the IGS can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","netweaver","sap","selfhosted","vendor"],"campaign_type":null,"search_a":"'-109806':14A,17A '-2026':13A,16A 'craft':3A 'crash':6A 'cve':12A,15A 'graphic':8A 'imag':4A 'internet':7A 'netweav':2A 'repeat':11A 'request':5A 'sap':1A 'servic':9A 'worker':10A","search_b":"'attack':50B 'caus':44B 'certain':33B 'confidenti':69B 'craft':38B 'data':43B,66B 'effect':64B 'graphic':28B 'host':22B 'imag':42B 'input':34B 'integ':46B 'integr':67B 'internet':27B 'make':52B 'malform':41B 'netweav':18B,25B 'overflow':47B 'process':55B 'repeat':57B 'request':39B 'sap':19B,24B 'self':21B 'self-host':20B 'servic':29B,60B 'take':58B 'termin':56B 'unauthent':49B 'valid':32B 'valu':35B 'vendor':23B 'worker':54B","search_c":"'avail':118C 'certain':79C 'confidenti':125C 'contain':94C 'could':88C 'craft':92C 'data':97C 'graphic':73C 'high':115C 'imag':96C 'impact':116C,121C 'incom':83C 'input':80C 'integ':100C 'integr':123C 'internet':72C 'lead':103C 'malform':95C 'netweav':71C 'overflow':101C 'process':110C 'repeat':105C 'request':84C,93C 'result':112C 'sap':70C 'send':89C 'servic':74C 'special':91C 'suffici':77C 'termin':106C 'trigger':98C 'unauthent':86C 'user':87C 'valid':78C 'valu':81C 'within':82C 'worker':109C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T01:17:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"cna@sap.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109806","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109806","severity":null,"published_at":"2026-11-10T01:17:14+00:00","modified_at":"2026-11-10T01:17:14+00:00","first_seen_at":"2026-11-10T01:26:38+00:00","fetched_at":"2026-11-10T01:26:38+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-109806:2390","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109806","severity":null,"published_at":"2026-11-10T01:34:57+00:00","modified_at":"2026-11-10T01:34:57+00:00","first_seen_at":"2026-11-10T01:34:57+00:00","fetched_at":"2026-11-10T01:34:57+00:00","note":"SAP Security Note is behind SAP for Me login and not public; patch day page not yet populated. Only NVD/CVE record (via aggregator cve.imfht.com) lists component BC-FES-IGS 7.20EXT. No fix, patch level or PoC found; no exploitation reported. Nothing verified. Revisit when SAP Nov 2026 patch day page lists the note.","cites":["https://nvd.nist.gov/vuln/detail/CVE-2026-109806"]}],"documents":[{"id":112467,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109806","title":"NVD: CVE-2026-109806","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}