---
id: "CVE-2026-109806"
page: "https://infrastack.ai/live/CVE-2026-109806"
kind: "vulnerability"
aliases: ["CVE-2026-109806"]
title: "SAP NetWeaver: crafted image request crashes Internet Graphics Service worker repeatedly"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["netweaver", "sap", "self-hosted", "vendor"]
not_affected_if: ["service-not-running"]
published_at: "2026-11-10T01:17:14+00:00"
first_seen_at: "2026-11-10T01:26:38+00:00"
updated_at: "2026-11-10T01:34:57+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109806", "first_seen_at": "2026-11-10T01:26:38+00:00"}, {"source": "analyst", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109806", "first_seen_at": "2026-11-10T01:34:57+00:00", "cites": ["https://nvd.nist.gov/vuln/detail/CVE-2026-109806"]}]
exploit_sources: []
---

# SAP NetWeaver: crafted image request crashes Internet Graphics Service worker repeatedly

Link for people: https://infrastack.ai/live/CVE-2026-109806 (this .md is for agents)

SAP NetWeaver's Internet Graphics Service does not validate certain input values, so a crafted request with malformed image data causes an integer overflow. An unauthenticated attacker can make the worker process terminate repeatedly, taking the service down, with no effect on data integrity or confidentiality.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Check whether the SAP Internet Graphics Service (IGS, component BC-FES-IGS) runs in your landscape (the igswd process / IGS instance), then look up CVE-2026-109806 in SAP for Me Security Notes for the affected release and patch level. The CVE record lists BC-FES-IGS 7.20EXT; the fixed patch level is unknown until the SAP note is read.

## Timeline

- 2026-11-10T01:26:38+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-109806
- 2026-11-10T01:34:57+00:00 analyst https://nvd.nist.gov/vuln/detail/CVE-2026-109806 — SAP Security Note is behind SAP for Me login and not public; patch day page not yet populated. Only NVD/CVE record (via aggregator cve.imfht.com) lists component BC-FES-IGS 7.20EXT. No fix, patch level or PoC found; no exploitation reported. Nothing verified. Revisit when SAP Nov 2026 patch day page lists the note.

## Documents

- [describes] NVD: CVE-2026-109806 https://nvd.nist.gov/vuln/detail/CVE-2026-109806

## From the sources

SAP NetWeaver (Internet Graphics Service) does not sufficiently validate certain input values within incoming requests. An unauthenticated user could send a specially crafted request containing malformed image data, triggering an integer overflow that leads to repeated termination of the worker process. This results in a high impact on availability with no impact on integrity or confidentiality.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_